Added state opened ports watcher; allow opening/closing port ranges on units

Taking over the work Domas did in https://github.com/juju/juju/pull/517 and splitting this, 
as requested by reviewers in 4 chunks. This is 1/4 and is only
about changes in the state package.

Ports opened on a unit are now migrated to the openedPorts collection
on subsequent OpenPort/ClosePort calls, but the Ports list on the
unit document is not reset yet, as it's better done in a follow-up
one in an upgrade step.

Next: 2/4: upgrade step to migrate ports from units to openedPorts
collection; 3/4: firewaller api changes to enable watching ports;
4/4: firewaller worker using the new api.
Doing this in a defer seems like it would be harder to follow the code flow. Are there just that many possible ways that we can return with no-error?