[Fix] use command to bypass curl/wget shell functions and aliases

zsh (and interactive bash with `expand_aliases`) bakes a preexisting `curl` alias into nvm's function bodies at source time,
and shell functions named `curl`/`wget` shadow the binaries at call time - either one breaks downloads.
Prefixing invocations with `command` bypasses both: here, `nvm_download`'s dispatch, `nvm_curl_version`, `nvm_curl_libz_support`, and the wget branch of `nvm_get_latest`;
the remaining bare `curl` invocations in `nvm_get_latest` and the install script are prefixed in a followup commit.

The tests that previously mocked curl/wget as shell functions now install fake executables on PATH instead,
via a shared `make_fake_curl` helper in `test/common.sh`,
and a new test asserts the bypass.

Refs #2923

test/fast/Unit tests/nvm_curl_use_compression

@@ -1,18 +1,25 @@
 #!/bin/sh
 
+WORK="$PWD/nvm_curl_use_compression-work.$$"
+TEST_BIN="$WORK/bin"
+
 cleanup () {
   unset -f die
+  rm -rf "$WORK"
+  export PATH="$OLDPATH"
 }
 
 die () { echo -e "$@" ; cleanup ;  exit 1; }
 
 NVM_ENV=testing \. ../../../nvm.sh
 
-curl() {
-  if [ "$1" = "-V" ]; then
-    echo "${VERSION_MESSAGE}"
-  fi
-}
+\. ../../common.sh
+
+OLDPATH="$PATH"
+
+make_fake_curl "$TEST_BIN"
+
+export PATH="$TEST_BIN:$OLDPATH"
 
 CURL_VERSION_ON_ARCHLINUX_WITH_LIBZ="curl 7.54.0 (x86_64-pc-linux-gnu) libcurl/7.54.0 OpenSSL/1.1.0f zlib/1.2.11 libpsl/0.17.0 (+libicu/59.1) libssh2/1.8.0 nghttp2/1.22.0
 Protocols: dict file ftp ftps gopher http https imap imaps pop3 pop3s rtsp scp sftp smb smbs smtp smtps telnet tftp