cmd/jujud: restrict API logins during upgrades

Use the recently introduced API login validation functionality to only
allow client and local machine agent logins while upgrade steps are
running. The goal is minimise database activity during upgrades,
specifically for schema migrations.

As well as the unit tests, this change has been heavily tested
manually.