sh: Fix corruption of CTL* bytes in positional parameters in redirection.

EXP_REDIR was not being checked for while expanding positional parameters in
redirection, so CTL* bytes were not being prefixed where they should be.

MFC after: 1 week