Ports document now used to store opened ports for machine/network tuple.

This patch is the beginning of a solution for #1216644 . 

To implement this, a new openedPorts collection is introduced, with a ports document for each machine and network (only the "juju-public" network is supported at the moment).

Any existing port entries in the unit document are migrated to the ports document. New ports are still appended to the ports list in the unit document - this functionality will be removed when the firewaller is updated to watch the openedPorts collection.
So what happens here, if we're using an old deployment of juju before adding the openedPorts collection? If get returns an error when the collection or document is no present, this will introduce a regression - won't it?