Backport bugfix for BUG_CSUBSTDO from ksh93v- 2012-08-24 (#259)

This commit fixes BUG_CSUBSTDO, which could break stdout inside of
non-forking command substitutions. The breakage only occurred when
stdout was closed outside of the command substitution and a file
descriptor other than stdout was redirected in the command substitution
(such as stderr). Thanks to the ast-open-history repo, I was able to
identify and backport the bugfix from ksh93v- 2012-08-24.

This backport may fix other bugs as well. On 93v- 2012-08-24 it
fixed the regression below, though it was not triggered on 93u+(m).
  src/cmd/ksh93/tests/heredoc.sh
  487 print foo > $tmp/foofile 
  488 x=$( $SHELL 2> /dev/null 'read <<< $(<'"$tmp"'/foofile) 2> /dev/null;print -r "$REPLY"') 
  489 [[ $x == foo ]] || err_exit '<<< $(<file) not working' 

src/cmd/ksh93/sh/io.c: sh_open():
- If the just-opened file descriptor exists in sftable and is
  flagged with SF_STRING (as in non-forking command substitutions,
  among other situations), then move the file descriptor to a
  number >= 10.

src/cmd/ksh93/tests/io.sh:
- Add a regression test for BUG_CSUBSTDO, adapted from the one in
  modernish.

TODO

@@ -23,12 +23,6 @@ https://github.com/modernish/modernish/tree/0.16/lib/modernish/cap/
   initial ! (and, on some shells, ^) retains the meaning of negation, even
   in quoted strings within bracket patterns, including quoted variables.
 
-- BUG_CSUBSTDO: If standard output (file descriptor 1) is closed before
-  entering a $(command substitution), and any other file descriptors are
-  redirected within the command substitution, commands such as 'echo' will
-  not work within the command substitution, acting as if standard output is
-  still closed.
-
 - BUG_IFSGLOBS: In glob pattern matching (as in case or parameter
   substitution with # and %), if IFS starts with ? or * and the "$*"
   parameter expansion inserts any IFS separator characters, those characters