state/apiserver/common: NewEnvironMachinesWatcher takes an authorizer

This PR removes the incorrect use of `canWatch("")`, replacing it with a call to the underlying authorizer as it is that authorizer which can tell if the authenticated entity is permitted to act as an Environment manager.

A similar change is coming for EnvironWatcher in a followup PR.
It fails because EnvironManger is false. This API method only cares if you, the authenticated entity, are an EnvironManager. it is an environment, not entity wide permission