Ports document now used to store opened ports for machine/network tuple.

This patch is the beginning of a solution for #1216644 . 

To implement this, a new openedPorts collection is introduced, with a ports document for each machine and network (only the "juju-public" network is supported at the moment).

Any existing port entries in the unit document are migrated to the ports document. New ports are still appended to the ports list in the unit document - this functionality will be removed when the firewaller is updated to watch the openedPorts collection.
Ideally, to avoid magic numbers, I'd define a type and set of consts like this:
```go
type portPart int

const (
    machineId portPart = iota
    networkId
)

func (p *Ports) extractPortIdPart(part portPart) (string, error) {
    if part != machineId && part != networkId {
        return "", fmt.Errorf("invalid ports document name part: %v", part)
    }
    if parts := portsIdRe.FindStringSubmatch(p.doc.Id); len(parts) == 3 {
        return parts[part], nil
    }
    return "", fmt.Errorf("invalid ports document name: %v", p.doc.Id)
}        
```