🐛 Fixed validation on theme install API parameters

fixes https://github.com/TryGhost/Team/issues/818

- validation on query parameters should be wrapped in `options` within
  `validation`
- this is missing from the theme install API endpoint so we don't force
  the parameters to be passed in
- Ghost throws a 500 if `ref` is not supplied because following code
  assumes we've checked the existence
- this commit wraps the two query parameter validation statements in
  an `options` object to ensure they exist - Ghost returns a 422 if
  missing

core/server/api/canary/themes.js

@@ -66,12 +66,14 @@ module.exports = {
             'ref'
         ],
         validation: {
-            source: {
-                required: true,
-                values: ['github']
-            },
-            ref: {
-                required: true
+            options: {
+                source: {
+                    required: true,
+                    values: ['github']
+                },
+                ref: {
+                    required: true
+                }
             }
         },
         permissions: {