Destroy machine when last principal unit removed.

This change causes a machine to be automatically removed when the last principal unit running on that machine is removed (remove-unit). If the machine is a parent to any containers, it is left alone.

Background:
https://bugs.launchpad.net/juju-core/+bug/1206532
https://bugs.launchpad.net/juju-core/+bug/1183309/comments/8

This could use more test coverage, but I'd like to get a general feel for how it's looking so far before I go much further with it. This is my first time mucking around with state transactions. Please let me know if I've got it right!

I haven't added an option to keep empty machines/containers around after removing the last unit. I'd like to see if we can avoid it. If we do need the option, I think it should be opt in. Let me know.
I'm hesitant to use "forceDestroyOps" in something that should be a clean teardown. Maybe call this "destroyOps", and have a different one for forceDestroyOps which includes the regular cleanup?
I guess my concern is that we should only be tearing down the machine automatically when it is already empty (but dirty), so we shouldn't need to run all the extra "make sure everything really is gone". Because if everything isn't gone, we shouldn't be tearing down the machine.