Port range support in the firewaller.

The firewaller watches the openedPorts collection, the ports field on units is no longer updated.

This work fixes https://bugs.launchpad.net/juju-core/+bug/1337817
Didn't we decide that we needed relation granularity, not just network granularity? ie that network was a consequence of relation?

...or, damn, I remember. You have to do other things and it's not going to be appreciably more costly to poke it in later (and in fact might be easier, because then we'll know how to handle the cases that don't actually have a real relation associated -- ie the ones that have already happened today). Would you add a reasonably-detailed comment to that effect please?