Port range support in the firewaller.

The firewaller watches the openedPorts collection, the ports field on units is no longer updated.

This work fixes https://bugs.launchpad.net/juju-core/+bug/1337817
I'm not sure that even mentioning a "ports document" is right, and I'm sure that leaking the database id here is not right. In fact I'm not *quite* sure this is an error: doesn't this state just indicate that everything is fine, there are no ports open for X machine on Y network, and everyone should be happy?