fix bad character checking in wordexp

the character sequence '$((' was incorrectly interpreted as the
opening of arithmetic even within single-quoted contexts, thereby
suppressing the checks for bad characters after the closing quote.

presently bad character checking is only performed when the WRDE_NOCMD
is used; this patch only corrects checking in that case.

src/misc/wordexp.c

@@ -77,6 +77,7 @@ static int do_wordexp(const char *s, wordexp_t *we, int flags)
 		if (!(sq|dq|np)) return WRDE_BADCHAR;
 		break;
 	case '$':
+		if (sq) break;
 		if (s[i+1]=='(' && s[i+2]=='(') {
 			i += 2;
 			np += 2;