[#5432] Test if callback is an array prior to accessing as array

- Callbacks can be strings, objects (functors), or closures, too.
- Allow testing against functor callbacks
[#5432] Added test

- Finally determined a way to add a test for this.
[#5432] CS fixes

- Trailing whitespace
[#5432] Incorporate feedback

- Simplify logic when introspecting callback
[#5432] Use array_shift instead of specific index access

- per @Maks3w
Add security disclosure info to README/CONTRIBUTING docs
Merge pull request #5468 from EvanDotPro/hotfix/security-disclosure

Add security disclosure info to README/CONTRIBUTING docs
Merge branch 'hotfix/5468'

Close #5468
Merge pull request #5432
Merge pull request #5432 in master
Merge remote-tracking branch 'zf2/master' into prod