(#9607) Only validate package source when it is set or needed

Previously, 'puppet resource package' failed on Windows, because the
resource 'instances' returned by the provider do not have a source
parameter set on them, causing validation to fail.

This commit moves validation of the source parameter into a
'validation' block in the 'source' parameter definition, It simply
delegates to its provider. In the default case, validation is a
no-op. In the Windows case, we validate that the source is not
empty. It's already known to not be nil.

It also adds validation to ensure the source parameter is defined when
it is used (during install and uninstall). It intentionally adds a
method named 'msi_source' instead of 'source' as the provider's class
already has a method with that name.