feat(api): Add Serializer[T] generic; pilot on environments

[azulus]

Make sentry.api.serializers.Serializer statically generic over its
serialized output type, so Response(serialize(obj, user, FooSerializer()))
type-checks against Response[T] end-to-end. Builds on the Response[T]
work in #116335 / #116433 / #116496 — closes the gap where
serialize()'s -> Any return defeated the new mypy plugin's body check.

Opt-in per serializer, no churn for unmigrated ones

T = TypeVar("T", default=Any) means class FooSerializer(Serializer):
keeps returning Any from the helper's perspective — every existing
call site is unaffected, including those that mutate the result
(data["key"] = ...). The new check fires only for serializers that
explicitly opt in by declaring Serializer[FooResponse].

Pilot: EnvironmentSerializer + OrganizationEnvironmentsEndpoint

# src/sentry/api/serializers/models/environment.py
class EnvironmentSerializer(Serializer[EnvironmentSerializerResponse]):
    ...

# src/sentry/core/endpoints/organization_environments.py
def get(
    self, request: Request, organization: Organization
) -> Response[list[EnvironmentSerializerResponse]]:
    ...
    return Response(serialize(list(queryset), request.user, EnvironmentSerializer()))

The 400 inline-validation Response({"detail": ...}, status=400)
converts to raise ParseError(...) so the return type is single-armed
— same pattern as the earlier Response[T] cluster work. DRF's
exception handler produces the same {"detail": "..."} body at
runtime; existing test assertions pass unchanged.

Drift caught at both ends

Verified synthetically. With the pilot serializer declared
Serializer[EnvironmentSerializerResponse]:

• Returning a wrong-shape body from the endpoint produces:
  Missing keys ("id", "name") for TypedDict +
  Extra key "wrong" for TypedDict.
• Declaring the serializer with a mismatched base produces both
  Return type ... incompatible with return type ... in supertype (at
  the serializer) and Argument 3 to "serialize" has incompatible type ... expected "Serializer[EnvironmentSerializerResponse]" (at the
  endpoint).

No stub file — typing lives in base.py

Two .pyi placements were tried during development:
fixtures/stubs-for-mypy/sentry/api/serializers/base.pyi and sibling
src/sentry/api/serializers/base.pyi. Both rejected: mypy ignores
stubs for internal modules when CI's files = ["."] puts the .py in
the check set. The runtime file is the single source of truth.
@overload decorators on serialize() provide the typed shape; the
no-serializer overload comes first to preserve Any for the
registry-lookup path. Three # type: ignore[return-value] on the base
Serializer method bodies cover the placeholder return None /
return {} cases — concrete subclasses override with real bodies that
satisfy T.

Deferred

• Extending the structural linter (feat(apidocs): Support union Response[T] annotations in structural linter #116496) to resolve
  responses={200: FooSerializer} to T via Serializer[T] bases.
  Useful once a handful of serializers are migrated; the bare class
  references continue to be skipped silently for now.
• Cluster migrations of additional serializers + endpoints.
• Kwargs-divergent serializers (e.g. IssueEventSerializer returning
  different shapes for different call args) stay un-generic.