firewaller: Ensure ports get closed for old CIDRs

[babbageclunk]

Description of change

Even if we're also opening them for another CIDR. This came up while
rejigging the GCE firewall handling - the firewaller would open the
ports for the new CIDR but not close them for the old one.

QA steps

• Bootstrap and create 2 models with a cross-model relation in GCE
• Stop and start a machine on the consuming side of the relation so that its public address changes.
• When the new address is noticed and the firewall rules updated, check that the old address is removed from the firewall rule.

[babbageclunk]

!!build!!

[babbageclunk]

$$merge$$

[jujubot]

Status: merge request accepted. Url: http://juju-ci.vapour.ws:8080/job/github-merge-juju

[jujubot]

Build failed: Tests failed
build url: http://juju-ci.vapour.ws:8080/job/github-merge-juju/10736

[babbageclunk]

Oops, build happened before my test fix got pushed.

$$merge$$

[jujubot]

Status: merge request accepted. Url: http://juju-ci.vapour.ws:8080/job/github-merge-juju

[jujubot]

Build failed: Tests failed
build url: http://juju-ci.vapour.ws:8080/job/github-merge-juju/10741

[babbageclunk]

Well, I don't understand what happened in that build - firewaller API tests timed out? I'm going to try again.

$$merge$$

[jujubot]

Status: merge request accepted. Url: http://juju-ci.vapour.ws:8080/job/github-merge-juju