cmd/jujud: restrict API logins during upgrades

Use the recently introduced API login validation functionality to only allow client and local machine agent logins while upgrade steps are running. The goal is minimise database activity during upgrades, specifically for schema migrations.

As well as the unit tests, this change has been heavily tested manually.

I'm not quite convinced that *this* particular API server having completed its upgrades is sufficient to determine that upgrades have actually completed... unless the last upgrade step for all API servers is always "wait for the leader to finish" its own upgrades.

I might need to reread the upgrades doc, I'll keep looking here for a bit though.