firewall: use curl instead of wget for ocf.io SNI

wget < 1.14 (i.e. on wheezy) doesn't do SNI, so can't connect to ocf.io