Capability detection for networker

In a first approach the decision on using the standard or the safe networker has been done based on the provider type. In case of all but MAAS the safe networker has been used. Now a new environment capability has been added, so that each provider can return if it requires a safe networker for the current machine. As this today depends on the machine (local provider dislikes the changes done by the networker on the bootstap node, because it's the host system) and if the machine has been manually provisioned.

Fixes #1354365.
I don't see any permission checks here - please use the pattern established with the other methods:

Before the loop:
```go
canRead, err := api.getCanRead()
if err != nil {
    return results, err
}
```

Inside the loop (if you're using Tags []names.Tag in the params struct, no need to parse the tag here), just do:
```go
if !canRead(tag) {
    return nil, common.ServerError(common.ErrPerm)
}  
```

And then continue with getMachine, etc. But, because we already checked for permissions, don't mask not found errors as ErrPerm, as we already know the agent is authorized, so just return the error as usual.