Add defensive typehinting for public methods for a cleaner API.

Follow up on https://github.com/cakephp/cakephp/pull/3775

As it got quite controversial I decided to extract the public API changes into this PR
and then will rebase the other one on top of it afterwards - so only the actually relevant changes around protected methods are then visible. 

One test fails:

    Argument 1 passed to iterator_to_array() must implement interface Traversable, null given

Keeping execute here does not work and throws this error:

> Argument 2 passed to Cake\ORM\ResultSet::__construct() must implement interface
Cake\Database\StatementInterface, instance of Mock_StatementInterface_6f4de918 g
iven, called in ...\src\ORM\Query.php on line 590 and defined ...

Removing it results in NULL for `$query->all()`, though.