Port range support in the firewaller.

The firewaller watches the openedPorts collection, the ports field on units is no longer updated.

This work fixes https://bugs.launchpad.net/juju-core/+bug/1337817
isn't there something a bit confused about the layering here? whatever creates the watcher results should surely be responsible for both result and error? so at this level I'd either expect (id, changes, err) or (stringsWatchResult) -- with all fields filled in. Either option is fine, but the mix is awkward.