Port range support in the firewaller.

The firewaller watches the openedPorts collection, the ports field on units is no longer updated.

This work fixes https://bugs.launchpad.net/juju-core/+bug/1337817
This all looks good but needs more tests -- in particular, you can test a *load* of auth stuff by passing unit tags, machine tags, total gibberish, etc, *and* a valid environ tag; and then checking that all the bad args got appropriate errors, and the good arg was correctly handled despite being in a thicket of bad.