sh: Fix executing wrong command with ${unsetvar#$(cmdsubst)}$(cmdsubst).

The parsed internal representation of words consists of a byte string with a
list of nodes (commands in command substitution). Each unescaped CTLBACKQ or
CTLBACKQ | CTLQUOTE byte corresponds to an entry in the list.

If param in ${param#%##%%word} is not set, the word is not expanded (in a
deviation of POSIX shared with other ash variants and ksh93). Erroneously,
the pointer in the list of commands (argbackq) was not advanced. This caused
the wrong command to be executed later if the outer word contained another
command substitution.

Example:

echo "${unsetvar#$(echo a)}$(echo b)"

wrote "a" but should write "b".

MFC after: 1 week