Hi Jon,
Just showing my appreciation for this blogpost here also. Change my reporting needs from /xmlpserver/services/v2/ReportService to /xmlpserver/services/ExternalREportWSSService, after reading this post. I have for some time wanted to get rid of the first service because of sending the passwords as part of payload. The external report service can user credentials as you point out in this article.
I have some findings, I will comment on here:
Your APEX demo payload is missing this tag (removed brackets), that you have in the curl demo: "pub:sizeOfDataChunkDownload -1 pub:sizeOfDataChunkDownload" I find it's needed to work.
This tag (removed brackets): "pub:attributeFormat csv pub:attributeFormat" It can be left out. It will return csv if the report is set up for csv and return xml if the report is set up for xml. If you do have it specified it need to be lowercase csv as in you demo. Uppercase will not work. For XML it's uppercase XML.