Prevent purchases of inapp on non public app (bug 1043590)

- Add form validation
- Add test
``self.addon.update(status=amo.STATUS_PENDING)`` should work too