Destroy machines instead of services as the default?

If you `destroy-service` it keeps the machine around. This is terrible on public clouds as people are removing services but the machine keeps running and getting billed.

The original rationale was that not all charms use persistant data -- and we defaulted to keeping them around just in case. We need to revisit this.

James Troup points out that we've always defaulted to keeping this around, and that switching the default behavior to destroying the machine when we've always defaulted to NOT destroying the machine is also dangerous.

Discussion on this is needed, we can probably just add confirmation prompts.

DISCUSSION

* By default we agree that, when we destroy a unit, if there's nothing else running on the machine, we destroy the machine. When the last unit on a machine is destroyed, we destroy the machine.
* Some users will require the machine to stay around, so we'll provide --keep-machine to destroy-unit and destroy-service.
* Sync with the GUI, make sure the machine view takes this into account.
* Manually killing machines and how juju handles that needs a separate discussion.
* We may want to add an environment flag to change the default behavior.
* Before changing this behavior, we should have a public discussion on the list to warn people and check for unintended complications.