Restrict allowed environments based on specified subprojects

[alex-mckenna]

Since #252, hoff has had support for merge and deploy messages which specify the subproject(s) to deploy. However, in some repositories it may be the case that not every subproject can be deployed to the same environments. This means currently if we have the following:

• subproject foo which has environments production and staging
• subproject bar which only has the environment production

we can run commands like this in hoff which merge correctly, but mismatch subprojects to environments, since we only keep a single global list of subprojects and environments. Ideally hoff would also know which environments are valid per-subproject and reject merge commands which make no sense.