Port range support in the firewaller.

The firewaller watches the openedPorts collection, the ports field on units is no longer updated.

This work fixes https://bugs.launchpad.net/juju-core/+bug/1337817
I'm wondering whether we can now do all this more cleanly as a one-shot upgrade step? That's not enough to block this, but it does again demand a comment.