Change state.User to take a names.UserTag

There are a few other drive by changes:
 - bootstrap agent test also checks created environment
 - the logging from the apiserver permission test has some breaks in it (to visually separate the test output when it fails)
 - the user manager made me sad, we are looking at consistency of tags/names
 - adding a service no longer enforces that the user exists, however an envuser must exist (remote users will exist soon)
 - the UserTag returned from state.User instances is now explicitly a local user tag (rather than implicitly)
Well, certainly not on the user collection.  I think we need to handle the use case where a service may have been added by someone who no longer has access.  We may even want to completely remove the owner from the service doc, so no, I don't think we still need this.