[#5432] Test if callback is an array prior to accessing as array

- Callbacks can be strings, objects (functors), or closures, too.
- Allow testing against functor callbacks
[#5432] Added test

- Finally determined a way to add a test for this.
[#5432] CS fixes

- Trailing whitespace
[#5432] Incorporate feedback

- Simplify logic when introspecting callback
[#5432] Use array_shift instead of specific index access

- per @Maks3w
Add security disclosure info to README/CONTRIBUTING docs
Merge pull request #5468 from EvanDotPro/hotfix/security-disclosure

Add security disclosure info to README/CONTRIBUTING docs
Merge branch 'hotfix/5468'

Close #5468
Merge pull request #5432
Merge pull request #5432 in master
Fix typehint for getServiceLocator().

It's always `ServiceLocatorInterface` because getServiceLocator() returns the contents of $this->serviceLocator which is set by setServiceLocator(ServiceLocatorInterface $sl).
Merge pull request #5471 from Thinkscape/patch-1

Fix typehint for getServiceLocator().
Merge branch 'hotfix/5471'

Close #5471