state/apiserver/common: NewEnvironMachinesWatcher takes an authorizer

This PR removes the incorrect use of `canWatch("")`, replacing it with a call to the underlying authorizer as it is that authorizer which can tell if the authenticated entity is permitted to act as an Environment manager.

A similar change is coming for EnvironWatcher in a followup PR.
My concern here is why this test fails.  It isn't obvious.