cmd/jujud: restrict API logins during upgrades

Use the recently introduced API login validation functionality to only allow client and local machine agent logins while upgrade steps are running. The goal is minimise database activity during upgrades, specifically for schema migrations.

As well as the unit tests, this change has been heavily tested manually.

I tried that first. The export_test trick only seems to work for tests in the same directory. No matter what  I tried the things exported in export_test weren't available in cmd/jujud upgrade_test.go. Am I missing something?