rest_validate_request_arg() should validate `type=array`

Just like we have type checks for `string` and `integer`, we should also have a type check for `array`.

However, when we do this, we'll need to address instances where we've typed the param to `array`, but also accept a CSV of ids.

Lastly, the type checks in this function should happen before any other checks.

From 470e59ad0a2b60270008e267c8f981527b833c79
