unused machine assignment ignores constraints

[William Reade]

When using a provider with the "unused" assignment policy (of which none currently exist), units may be assigned to machines that do not fit the constraints that should be applied to the unit.

When we use that policy, we should ensure that the unit's constraints are respected, such that units are only assigned to (1) provisioned machines whose instances match the unit's constraints or (2) unprovisioned machines, that can thus take new constraints from the unit (*before* they are provisioned by an eager provisioner).