Incentive fund loss when calling claim() in AutoPxGlp/PxGmxRewards because it calls this.compound(,,true) which would transfer incentive to contract itself and those funds won't be calculated as rewards or fee and won't be accessible to withdraw
Audit: 2022-11-redactedcartel-findings
Severity: HIGH

# Lines of code

https://github.com/code-423n4/2022-11-redactedcartel/blob/03b71a8d395c02324cb9fdaf92401357da5b19d1/src/vaults/PxGmxReward.sol#L101-L133


# Vulnerability details

## Impact
Function `claim()` in `PxGmxReward`  contract is used for claiming available `pxGMX` rewards of a user. but this function calls `IAutoPxGlp(address(this)).compound(1, 1, true);` to harvest new rewards and stake them to compound rewards. but this call is external call and the parameter `optOutIncentive` set as `true` so the `compound()` would try to transfer the incentive to `msg.sender` which is `AutoPxGmx` itself. the incentives (as `pxGlp` and `pxGmx` tokens) transferred to contract won't be considered as current or future reward or fee or anything and it would be lost forever (only `compound()` function handles the rewards and fees and it only handles the received rewards during the call to `PirexRewards.claim()` function and incentive transfer happens later in the `compound()` function). so This bug would cause some funds of contract(incentive) to be locked forever. those incentive should be transferred to a user who called the contract.

## Proof of Concept
This is `claim()` code in `PxGmxReward`:
```
    function claim(address receiver) external {
        if (receiver == address(0)) revert ZeroAddress();

        IAutoPxGlp(address(this)).compound(1, 1, true);
        _userAccrue(msg.sender);

        uint256 globalRewards = globalState.rewards;
        uint256 userRewards = userRewardStates[msg.sender].rewards;

        // Claim should be skipped and not reverted on zero global/user reward
        if (globalRewards != 0 && userRewards != 0) {
            // Update global and user reward states to reflect the claim
            globalState.rewards = globalRewards - userRewards;
            userRewardStates[msg.sender].rewards = 0;

            // Transfer the proportionate reward token amounts to the recipient
            uint256 _rewardState = rewardState;
            uint256 amount = (_rewardState * userRewards) / globalRewards;

            if (amount != 0) {
                // Update reward state (i.e. amount) to reflect reward tokens transferred out
                rewardState = _rewardState - amount;

                pxGmx.safeTransfer(receiver, amount);

                emit PxGmxClaimed(msg.sender, receiver, amount);
            }
        }
    }
```
As you can see it calls `compound()` function like this `IAutoPxGlp(address(this)).compound(1, 1, true);` to  compound `pxGLP` (and additionally `pxGMX`) rewards. this call is external call which would change the `msg.sender` as `AutoPxGlp` itself and it sets the value of `optOutIncentive` as true which would make contract to transfer incentive to `msg.sender` which is `AutoPxGlp` itself. This is `compound()` code in `AutoPxGlp` contract:
```
    function compound(
        uint256 minUsdg,
        uint256 minGlp,
        bool optOutIncentive
    )
        public
        returns (
            uint256 g