suhosin signature gave false positives

[helmo]

This gave a falsepositive when an en_US core is downloaded, but later another language is installed.

Can we remove the suhosin signature, or make it more specific to a malware usage?

Extracted from #139

[helmo]

Unfortunately I'm seeing more similar false positives.

E.g. the rot13 variant of eval

Evil code found: 
[!] Function (eval)
    - Encoded Function `eval`
      => riny

And the reverse:

[!] Function (eval)
    - Encoded Function `eval`
      => lave

All in the standard ./wp-content/languages/admin-it_IT.l10n.php file.
Example on 1819178

Maybe we could we download the checksum files for additional languages?