Firewaller using APIV1 when available, otherwise uses APIV0 and legacy code

Next step of supporting port ranges for charms. Renamed the
current (legacy) firewaller code to FirewallerV0, and its
tests as well moved in separate files with _v0 suffix (so it's
easier to drop them althogether).
We'll keep this legacy code for backwards compatibility
until there's an upgrade step in place that properly migrates
unit ports to machine+network port ranges in the DB.
Firewaller worker now uses API V1 if available, or falls back
to V0 transparently.
A few fixes were needed for the OpenedPortsWatcher again.
The core problem is that we leak globalKey-style things out of state, when state should be returning id-like things. There's a separate problem that the blasted watchers all send id-like things over the API when they should be tags, but I'd rather fix that all at once by having an id-translation step in the various api watchers.

So, as long as we're in no danger of releasing anything like this, it's fine to do it in a followup -- but please fix the state watcher to return "0:juju-public", or something like that, rather than returning tags directly, because that'll just make it harder to fix  all the others. Consistently wrong is (slightly) better than unpredictably right-or-wrong-who-knows.