Public / private paths security report is inaccurate when using HTTP proxy

Admin -> reports -> security report's core_publicpaths security check will misinterpret the CONNECT response of an outbound HTTP proxy as the destination's response

You can reproduce by setting a HTTP proxy, tested against squid but should apply to all, like so:

$CFG->proxyhost = 'outbound-proxy';

$CFG->proxyport = 3128;

$CFG->proxytype = 'HTTP';

And loading the "Check all public / private paths" security check
Note that every path shows a 200 no matter what the real response is

This happens because the response, coming back from curl, looks like this:

HTTP/1.1 200 Connection established

HTTP/1.1 404 Not Found 

And the code from line 233 on publicpaths.php just grabs the first line of response

This can be fixed by using CURLOPT_SUPPRESS_CONNECT_HEADERS to make the first line the destination's response

I did this in the form of adding `'suppress_connect_headers' => true` to line 214 of same file and confirmed report is now accurate

In my testing and per curl docs this does not have any effect if a HTTP proxy is not used in that particular curl handle so should be safe to do so even without a proxy set

Cheers