uniter: open(close)-port now sandboxed until hook is committed

An important improvement in supporting opening and
closing port ranges for charms is to also provide
sandboxing for these operations. This PR implements
an internal caching of all pending port ranges to
open or close for the unit, and only actually tries
to open or close them when a hook is run and about to
be committed.