Added state opened ports watcher; allow opening/closing port ranges on units

Taking over the work Domas did in https://github.com/juju/juju/pull/517 and splitting this, 
as requested by reviewers in 4 chunks. This is 1/4 and is only
about changes in the state package.

Ports opened on a unit are now migrated to the openedPorts collection
on subsequent OpenPort/ClosePort calls, but the Ports list on the
unit document is not reset yet, as it's better done in a follow-up
one in an upgrade step.

Next: 2/4: upgrade step to migrate ports from units to openedPorts
collection; 3/4: firewaller api changes to enable watching ports;
4/4: firewaller worker using the new api.
Same thing here, having a defer side effect of setting data semes weird, and it would be nice if building the transaction was a separate named function.
As a plus, you could actually just test that function in isolation as well.