state/apiserver/provisioner: refactor canWatchMachines logic

This proposal removes the last deliberate use of `canWatch("")` in the apiserver.

There are some inadvertent uses where the tag string passed to `canWatch` will be addressed in the next proposal.