state/apiserver/common: NewEnvironMachinesWatcher takes an authorizer

This PR removes the incorrect use of `canWatch("")`, replacing it with a call to the underlying authorizer as it is that authorizer which can tell if the authenticated entity is permitted to act as an Environment manager.

A similar change is coming for EnvironWatcher in a followup PR.
upgrades: added AreUpgradesDefined

This function return true if there are upgrade operations defined
between the version specified and the running software version. The
logic shared by this and PerformUpgrade has been extracted to an
iterator.
Use AreUpgradesDefined to decide agent if upgrade mode is needed

This moves the decision of whether an upgrade mode should be entered
to the upgrades package (where it should be) and also means upgrade
mode is only entered if there are actually upgrade steps defined.
Merge pull request #541 from mjs/are-upgrades-defined

Added updates.AreUpgradesDefined

Two bits:

1. Adds upgrades.AreUpgradesDefined which returns if there are upgrade operations defined between the version specified and the running software version. 
2. Use AreUpgradesDefined in the machine agent to decide whether upgrade mode should be entered. This moves the decision of whether an upgrade mode should be entered to the upgrades package where it should be and also means upgrade mode is only entered if there are actually upgrade steps defined.
Merge pull request #540 from davecheney/179-state-apiserver-common-environmachineswatcher-drop-canwatch

state/apiserver/common: NewEnvironMachinesWatcher takes an authorizer

This PR removes the incorrect use of `canWatch("")`, replacing it with a call to the underlying authorizer as it is that authorizer which can tell if the authenticated entity is permitted to act as an Environment manager.

A similar change is coming for EnvironWatcher in a followup PR.
state/apiserver/common: NewEnvironsWatcher takes an authorizer

This PR is a followup to #540, and removes the last incorrect use of canWatch(""), replacing it with a call to the underlying authorizer as it is that authorizer which can tell if the authenticated entity is permitted to act as an Environment manager.
state/apiserver/common: AuthAlways requires a valid tag

AuthAlways would previously authenticate any string, even if it was not a valid tag.

This made it a poor mock, not to mention a potential security risk.

This PR requires AuthAlways to validate the tag it is passed and will only return true if the tag is valid. This prepares for latter changes which will alter the signature of common.AuthFunc to require a tag, not a string.
update commentary
Merge pull request #543 from davecheney/180--state-apiserver-common-environwatcher-drop-canwatch

state/apiserver/common: NewEnvironsWatcher takes an authorizer

This PR is a followup to #540, and removes the last incorrect use of canWatch(""), replacing it with a call to the underlying authorizer as it is that authorizer which can tell if the authenticated entity is permitted to act as an Environment manager.
Merge branch 'master' of https://github.com/juju/juju into 181-state-apiserver-common-authalways-requires-valid-tag
Merge pull request #545 from davecheney/181-state-apiserver-common-authalways-requires-valid-tag

state/apiserver/common: AuthAlways requires a valid tag

AuthAlways would previously authenticate any string, even if it was not a valid tag.

This made it a poor mock, not to mention a potential security risk.

This PR requires AuthAlways to validate the tag it is passed and will only return true if the tag is valid. This prepares for latter changes which will alter the signature of common.AuthFunc to require a tag, not a string.
added newmetrics function to testing factory
unique strings for makemetrics
Merge pull request #546 from mattyw/metric-factory

added newmetrics function to testing factory

Added a MakeMetric function to the testing factory