Add defensive typehinting for public methods for a cleaner API.

Follow up on https://github.com/cakephp/cakephp/pull/3775

As it got quite controversial I decided to extract the public API changes into this PR
and then will rebase the other one on top of it afterwards - so only the actually relevant changes around protected methods are then visible. 

One test fails:

    Argument 1 passed to iterator_to_array() must implement interface Traversable, null given