state/apiserver/provisioner: refactor canWatchMachines logic
Merge pull request #534 from davecheney/178-state-apiserver-provisioner-refactor-canwatchmachines-logic

state/apiserver/provisioner: refactor canWatchMachines logic

This proposal removes the last deliberate use of `canWatch("")` in the apiserver.

There are some inadvertent uses where the tag string passed to `canWatch` will be addressed in the next proposal.