state/apiserver/common: NewEnvironMachinesWatcher takes an authorizer

This PR removes the incorrect use of `canWatch("")`, replacing it with a call to the underlying authorizer as it is that authorizer which can tell if the authenticated entity is permitted to act as an Environment manager.

A similar change is coming for EnvironWatcher in a followup PR.
Merge pull request #540 from davecheney/179-state-apiserver-common-environmachineswatcher-drop-canwatch

state/apiserver/common: NewEnvironMachinesWatcher takes an authorizer

This PR removes the incorrect use of `canWatch("")`, replacing it with a call to the underlying authorizer as it is that authorizer which can tell if the authenticated entity is permitted to act as an Environment manager.

A similar change is coming for EnvironWatcher in a followup PR.