state/apiserver/common: drop EnvironWatcher.canWatch

In all cases canWatch was being populated with the common.AuthAlways factory; in effect canWatch(anything) would always return true.

The only case where it did not return true was in our unit test cases which would force the value to be false to generate a suprious ErrPerm which was then validated by the tests.