Re-fix 'test -t 1' in command substitutions (re: 090b65e7)

Since a command substitution no longer forks on non-permanently
redirecting standard output within it for a specific command,
test -t 1, [ -t 1 ], and [[ -t 1 ]] broke as follows:
v=$(test -t 1 >/dev/tty && echo ok) did not assign 'ok' to v.
This is because the assumption in tty_check() that standard output
is never on a terminal in a non-forked command substitution, added
in 55f0f8ce, was made invalid by 090b65e7.

src/cmd/ksh93/edit/edit.c: tty_check():
- Implement a new method. Return false if the file descriptor
  stream is of type SF_STRING, which is the case for non-forked
  command substitutions -- it means the sfio stream writes directly
  into a memory area. This can be checked with the sfset(3)
  function (see src/lib/libast/man/sfio.3). To avoid a segfault
  when accessing sh.sftable, we need to validate the FD first.

src/cmd/ksh93/tests/pty.sh:
- Add the above reproducer.

src/cmd/ksh93/tests/pty.sh

@@ -581,6 +581,7 @@ actual=$(echo begin; exec >/dev/tty; [ -n X -a -t ] && test -n X -a -t) \
 # [ -t 1 ] to fail in non-comsub virtual subshells.
 ( test -t 1 ) && echo OK9 || echo 'test -t 1 in virtual subshell fails'
 ( test -t ) && echo OK10 || echo 'test -t in virtual subshell fails'
+got=$(test -t 1 >/dev/tty && echo ok) && [[ $got == ok ]] && echo OK11 || echo 'test -t 1 in comsub fails'
 EOF
 tst $LINENO <<"!"
 L test -t 1 inside command substitution
@@ -599,6 +600,7 @@ r ^OK7\r\n$
 r ^OK8\r\n$
 r ^OK9\r\n$
 r ^OK10\r\n$
+r ^OK11\r\n$
 r ^:test-2:
 !