state/apiserver/common: NewEnvironsWatcher takes an authorizer

This PR is a followup to #540, and removes the last incorrect use of canWatch(""), replacing it with a call to the underlying authorizer as it is that authorizer which can tell if the authenticated entity is permitted to act as an Environment manager.