refs https://github.com/TryGhost/Team/issues/1104
- better matches the context of the request as we're validating known keys and valid options from multiple settings
- "404 Not Found" didn't make sense because `/custom_theme_settings/` _does_ exist, it's just that one setting key wasn't known
- "400 Bad Request" didn't make sense because the request was understood, it just failed validation of the setting values
refs https://github.com/TryGhost/Team/issues/1104
- there was a mismatch of template options when throwing error on invalid select value meaning we were erroring but with the wrong error type and message
- added missing `lodash` dependency in package.json
