Migrate unit ports to machine port ranges

Upgrade step implemented to migrate ports from all unit
documents into port ranges on their assigned machine.
Because before we didn't have any validation for ports,
now during the migration it's guaranteed only valid and
non-conflicting port ranges are migrated.

Firewaller worker using APIV0 is removed, but the APIV0
itself will be dropped in a follow-up.

Ports documents are now properly removed when the last
port range is closed. Removing a unit now also removes
any opened port ranges for it, as well as removing the
machine (forcibly or normally) removes its ports doc.

OpenedPortsWatcher in state is fixed (yet again) to
properly report removals.

A few drive-by fixes for better user experience, logging,
and more tests added.