Added state opened ports watcher; allow opening/closing port ranges on units

Taking over the work Domas did in https://github.com/juju/juju/pull/517
and splitting this, as requested by reviewers in 4 chunks. This is 1/4
nd is only about changes in the state package.

Ports opened on a unit are now migrated to the openedPorts collection
on subsequent OpenPort/ClosePort calls, but the Ports list on the
unit document is not reset yet, as it's better done in a follow-up
one in an upgrade step.

Next: 2/4: upgrade step to migrate ports from units to openedPorts
ollection; 3/4: firewaller api changes to enable watching ports;
4/4: firewaller worker using the new api.