Re-fix 'test -t 1' in command substitutions (re: 090b65e7)

Since a command substitution no longer forks on non-permanently
redirecting standard output within it for a specific command,
test -t 1, [ -t 1 ], and [[ -t 1 ]] broke as follows:
v=$(test -t 1 >/dev/tty && echo ok) did not assign 'ok' to v.
This is because the assumption in tty_check() that standard output
is never on a terminal in a non-forked command substitution, added
in 55f0f8ce, was made invalid by 090b65e7.

src/cmd/ksh93/edit/edit.c: tty_check():
- Implement a new method. Return false if the file descriptor
  stream is of type SF_STRING, which is the case for non-forked
  command substitutions -- it means the sfio stream writes directly
  into a memory area. This can be checked with the sfset(3)
  function (see src/lib/libast/man/sfio.3). To avoid a segfault
  when accessing sh.sftable, we need to validate the FD first.

src/cmd/ksh93/tests/pty.sh:
- Add the above reproducer.

src/cmd/ksh93/edit/edit.c

@@ -161,13 +161,11 @@ int tty_check(int fd)
 {
 	register Edit_t *ep = (Edit_t*)(shgd->ed_context);
 	struct termios tty;
-	/*
-	 * The tty_get check below does not work on 1 (stdout) in command substitutions. But comsubs fork upon redirecting 1,
-	 * and forking resets sh.subshell to 0, so we can safely return false when in a virtual subshell that is a comsub.
-	 */
-	if(fd==1 && sh.subshell && sh.comsub)
-		return(0);
+	Sfio_t *sp;
 	ep->e_savefd = -1;
+	if(fd < 0 || fd > shgd->lim.open_max || sh.fdstatus[fd] == IOCLOSE
+	|| (sp = sh.sftable[fd]) && (sfset(sp,0,0) & SF_STRING))
+		return(0);
 	return(tty_get(fd,&tty)==0);
 }