Implemented firewall-mode: none; fixed firewaller tests

Unitl now we only supported "global" and "instance" values for the
"firewall-mode" environment setting. Not all clouds support
firewalling, security groups, or other means of implementing OpenPort
and ClosePort on either global or instance level (e.g. OpenStack
without os-security-groups extension installed). Hence, this PR
introduces a new "none" value for "firewall-mode". If specified, the
firewaller worker won't be started and we won't try to open or close
ports at all.

As a drive-by fix, firewaller tests are improved and "global mode"
tests re-enabled after they were effectively disabled by introducing
FirewallGlobalModeSuite in https://codereview.appspot.com/70190050/
(https://code.launchpad.net/~waigani/juju-core/get-oldConfig-from-state/+merge/209569 branch), but not registered, so no global mode test were run
since then.