🐛 Fixed validation on theme install API parameters

fixes https://github.com/TryGhost/Team/issues/818

- validation on query parameters should be wrapped in `options` within
  `validation`
- this is missing from the theme install API endpoint so we don't force
  the parameters to be passed in
- Ghost throws a 500 if `ref` is not supplied because following code
  assumes we've checked the existence
- this commit wraps the two query parameter validation statements in
  an `options` object to ensure they exist - Ghost returns a 422 if
  missing

core/server/api/canary/themes.js

@@ -66,6 +66,7 @@ module.exports = {
             'ref'
         ],
         validation: {
+            options: {
                 source: {
                     required: true,
                     values: ['github']
@@ -73,6 +74,7 @@ module.exports = {
                 ref: {
                     required: true
                 }
+            }
         },
         permissions: {
             method: 'add'