potential upgrade-charm bugs

[William Reade]

Hey guys

It crosses my mind that there are some interesting failure cases around
upgrading charms whose metadata changes significantly; for example, a
subordinate service could suddenly become non-subordinate (or vice
versa); or interfaces could be added or removed.

It seems, offhand, that interfaces can be added safely, but interface
removal is trickier: it *can* be safe, but only if no relations are
using that interface (and we don't have any checks for that either). So
I feel we should allow these cases (with appropriate checks).

However, I don't think that it ever makes sense to upgrade a service's
charm and change subordination status in the process, and I think we
should just flat-out refuse such attempts.

Opinions?

Cheers
William