ash: parser: Fix parameter expansion inside inner double quotes

ash: parser: Fix parameter expansion inside inner double quotes

Upstream email:

    parser: Fix parameter expansion inside inner double quotes

    The parsing of parameter expansion inside inner double quotes
    breaks because we never look for ENDVAR while innerdq is true.

            echo "${x#"${x+''}"''}

    This patch fixes it by pushing the syntax stack if innerdq is
    true and we enter a new parameter expansion.

    This patch also fixes a corner case where a bad substitution error
    occurs within arithmetic expansion.

    Reported-by: Denys Vlasenko <vda.linux@googlemail.com>
    Fixes: ab1cecb40478 (" parser: Add syntax stack for recursive...")
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
function                                             old     new   delta
readtoken1                                          2880    2898     +18

Signed-off-by: Denys Vlasenko <vda.linux@googlemail.com>