fix(mutt): rewrite ${cur/#!/X} to X${cur:1} against patsub_replacement

The construct cur="${cur/#!/$spoolfile}" tries to replace the first
character of `cur` with the content of $spoolfile.  However, this has
a problem that the characters `&` in $spoolfile can be unexpectedly
replaced with the matched string when `shopt -s patsub_replacement`
(bash >= 5.2) is enabled.

In principle, we can rewrite it to `cur=${cur/#!/"$spoolfile"}`, but
we can use a simpler solution this time.  In this context, `cur` is
ensured to start with `!`, so we can directly replace
${cur/#!/$spoolfile} with $spoolfile${cur:1}.

completions/mutt

@@ -138,7 +138,7 @@ _comp_cmd_mutt__filedir()
             command sed -e 's|^spoolfile=\"\(.*\)\"$|\1|')"
         if [[ $spoolfile ]]; then
             _comp_dequote "\"$spoolfile\"" && spoolfile=$REPLY
-            cur="${cur/#!/$spoolfile}"
+            cur=$spoolfile${cur:1}
         fi
     fi
     _comp_compgen -c "$cur" filedir