sh.lang: Introduce "command-substitution" context
Following comments in #94 (closed), this MR introduces "command-substitution" context, and precises the scope of "backtick-subshell" context. This allows to refine boundaries for "subshell" context (which is no longer confused with command substitution), and to improve slightly "double-quoted-string" context (in particular).