Port range support in the firewaller.

The firewaller watches the openedPorts collection, the ports field on units is no longer updated.

This work fixes https://bugs.launchpad.net/juju-core/+bug/1337817
Hideous and in need of fixing as it may be, surely we ought to be getting this from the params rather than injecting it here? And... we're on the API server, on an environment-specific connection. *surely* we know the environment tag here, and don't have to resort to this?