Fix corner-case >&- redirection leak out of subshell

Reproducer:

    exec 9>&1
    ( { exec 9>&1; } 9>&- )
    echo "test" >&9 # => 9: cannot open [Bad file descriptor]

The 9>&- incorrectly persists beyond the { } block that it
was attached to *and* beyond the ( ) subshell. This is yet another
bug with non-forking subshells; forking it with something like
'ulimit -t unlimited' works around the bug.

In over a year we have not been able to find a real fix, but I came
up with a workaround that forks a virtual subshell whenever it
executes a code block with a >&- or <&- redirection attached. That
use case is obscure enough that it should not cause any performance
regression except in very rare corner cases.

src/cmd/ksh93/sh/xec.c: sh_exec(): TSETIO:
- This is where redirections attached to code blocks are handled.
  Check for a >&- or <&- redirection using bit flaggery from
  shnodes.h and fork if we're executing such in a virtual subshell.

Resolves: https://github.com/ksh93/ksh/issues/161
Thanks to @ko1nksm for the bug report.

src/cmd/ksh93/sh/xec.c

@@ -1821,6 +1821,22 @@ int sh_exec(register const Shnode_t *t, int flags)
 			int 	jmpval, waitall = 0;
 			int 	simple = (t->fork.forktre->tre.tretyp&COMMSK)==TCOM;
 			struct checkpt *buffp = (struct checkpt*)stkalloc(sh.stk,sizeof(struct checkpt));
+			if(sh.subshell && !sh.subshare && t->fork.forkio)
+			{
+				/* Subshell forking workaround for https://github.com/ksh93/ksh/issues/161
+				 * Check each redirection for >&- or <&-
+				 * TODO: find the elusive real fix */
+				struct ionod *i = t->fork.forkio;
+				do
+				{
+					if((i->iofile & ~(IOUFD|IOPUT)) == (IOMOV|IORAW) && !strcmp(i->ioname,"-"))
+					{
+						sh_subfork();
+						break;
+					}
+				}
+				while(i = i->ionxt);
+			}
 			sh_pushcontext(buffp,SH_JMPIO);
 			if(type&FPIN)
 			{