Added state opened ports watcher; allow opening/closing port ranges on units

Taking over the work Domas did in https://github.com/juju/juju/pull/517 and splitting this, 
as requested by reviewers in 4 chunks. This is 1/4 and is only
about changes in the state package.

Ports opened on a unit are now migrated to the openedPorts collection
on subsequent OpenPort/ClosePort calls, but the Ports list on the
unit document is not reset yet, as it's better done in a follow-up
one in an upgrade step.

Next: 2/4: upgrade step to migrate ports from units to openedPorts
collection; 3/4: firewaller api changes to enable watching ports;
4/4: firewaller worker using the new api.
The intermediate helpers should probably see use further down the line, where parts of the ports document id (machine id and network name) need to be revealed without exposing clients to the document id itself.