state/apiserver/common: NewEnvironsWatcher takes an authorizer

This PR is a followup to #540, and removes the last incorrect use of canWatch(""), replacing it with a call to the underlying authorizer as it is that authorizer which can tell if the authenticated entity is permitted to act as an Environment manager.
Merge pull request #543 from davecheney/180--state-apiserver-common-environwatcher-drop-canwatch

state/apiserver/common: NewEnvironsWatcher takes an authorizer

This PR is a followup to #540, and removes the last incorrect use of canWatch(""), replacing it with a call to the underlying authorizer as it is that authorizer which can tell if the authenticated entity is permitted to act as an Environment manager.