Fix for fetchAll(...) not receiving whitelisted query params

Fixes #32 

The whitelisting logic was being executed in the `getList.post` event handler, which fires *after* the `ZF\Rest\AbstractResourceListener` runs its `dispatch`. (too late!)

This PR extracts the whitelisting logic and puts it in a `getList.pre` handler, that runs before the `dispatch`. The remaining `getList.post` logic is preserved so that the collection route options can still be set, and so on.

Existing tests work, and I added an additional one to check that the whitelist query params were set correctly.

Additional note: This includes a lot of `instanceof` checks with early returns in the listeners because I wasn't sure if I could assume that the instances obtained would be of those types. If this concern is unwarranted, then they can certainly be removed to keep things more concise.
Same comment as above -- we _know_ the resource is injected.