Fix for fetchAll(...) not receiving whitelisted query params

Fixes #32 

The whitelisting logic was being executed in the `getList.post` event handler, which fires *after* the `ZF\Rest\AbstractResourceListener` runs its `dispatch`. (too late!)

This PR extracts the whitelisting logic and puts it in a `getList.pre` handler, that runs before the `dispatch`. The remaining `getList.post` logic is preserved so that the collection route options can still be set, and so on.

Existing tests work, and I added an additional one to check that the whitelist query params were set correctly.

Additional note: This includes a lot of `instanceof` checks with early returns in the listeners because I wasn't sure if I could assume that the instances obtained would be of those types. If this concern is unwarranted, then they can certainly be removed to keep things more concise.