state/apiserver/keymanager: canRead/canWrite is not a common.AuthFunc

This PR is a prereq of #556.

On investigation the `canRead`, `canWrite` authz methods in the keymanager are not implementations of `common.AuthFunc` as they do not use tags.

Although with the current defintion of `common.AuthFunc` the are interchangable, when #556 lands they not be as the `user` field transmitted over the api is not a tag.

To make this clear, stop defining `canRead` and `canWrite` in terms of `common.AuthFunc` to make this difference crystal clear.