Checks whether a forwarder token and environment ID are a usable
pair, and any asset groups the forwarder will join are static groups
in that environment, before a forwarder is installed with them.

Forwarder installers take these values from whoever is running the
install. A typo in the token or environment produces a forwarder that
starts cleanly and then silently never reports, and a bad group fails
its registration. Call this first and gate the install on valid.

This is the one endpoint on this API that does NOT authenticate
with the Authorization header: the credential under test is
supplied in the request body instead, because the caller is trying
to find out whether it is a credential at all. Send nothing in the
Authorization header.

The response is deliberately a bare boolean. It never reveals
whether an environment exists, who owns it, or why a configuration
was rejected.

Callers MUST treat HTTP 429 as "try again shortly", never as
"invalid". The endpoint is rate limited, and answering a 429 as
though it were a validation failure would block installs that are
perfectly well configured. Retry with backoff instead.

Only rejected answers count against the limit, so a large, correctly
configured rollout does not accumulate against it however many
endpoints it covers. Repeatedly asking about a configuration that is wrong
is what will eventually be throttled.