Backport bugfix for BUG_CSUBSTDO from ksh93v- 2012-08-24 (#259)

This commit fixes BUG_CSUBSTDO, which could break stdout inside of
non-forking command substitutions. The breakage only occurred when
stdout was closed outside of the command substitution and a file
descriptor other than stdout was redirected in the command substitution
(such as stderr). Thanks to the ast-open-history repo, I was able to
identify and backport the bugfix from ksh93v- 2012-08-24.

This backport may fix other bugs as well. On 93v- 2012-08-24 it
fixed the regression below, though it was not triggered on 93u+(m).
  src/cmd/ksh93/tests/heredoc.sh
  487 print foo > $tmp/foofile 
  488 x=$( $SHELL 2> /dev/null 'read <<< $(<'"$tmp"'/foofile) 2> /dev/null;print -r "$REPLY"') 
  489 [[ $x == foo ]] || err_exit '<<< $(<file) not working' 

src/cmd/ksh93/sh/io.c: sh_open():
- If the just-opened file descriptor exists in sftable and is
  flagged with SF_STRING (as in non-forking command substitutions,
  among other situations), then move the file descriptor to a
  number >= 10.

src/cmd/ksh93/tests/io.sh:
- Add a regression test for BUG_CSUBSTDO, adapted from the one in
  modernish.

src/cmd/ksh93/tests/io.sh

@@ -785,5 +785,15 @@ then
 		"(expected $(printf %q "$expect"), got $(printf %q "$actual"))"
 fi
 
+# ======
+# Test for BUG_CSUBSTDO: If stdout is closed before running a command substitution,
+# redirecting any file descriptor in the command substitution would break stdout
+# inside of the command substitution. This only occurred when redirecting any other
+# file descriptor inside of the command substitution.
+exp='Foo bar'
+{ got=$(echo 'Foo bar' 2>/dev/null); } >&-
+[[ $exp == $got ]] || err_exit "BUG_CSUBSTDO: Closing stdout outside of command substitution breaks stdout inside of command substitution" \
+	"(expected $(printf %q "$exp"), got $(printf %q "$got"))"
+
 # ======
 exit $((Errors<125?Errors:125))