Change the FormatListener from a controller to a request event

Controller events are not always called, when for example using the Security layer. As the FormatListener was listening on a controller event, the format negation was not executed, and the response format after a AuthenticationException or AccessDeniedException was always html.

Changing the listener to a request event fixes the issue.

This PR fixes:
- FriendsOfSymfony/FOSRestBundle#548
- FriendsOfSymfony/FOSRestBundle#381