[Fix] nvm_download, nvm_get_latest, install.sh: pass -q to curl first, so .curlrc is ignored again

curl only skips reading `.curlrc` when `-q` is its very first argument;
anywhere else, the config file has already been read by the time `-q` is seen.
a4f89c62 added `-q` to every curl call so that a user's `.curlrc` would not affect nvm,
but 6a3b1dd2 (v0.33.2)
put `--compressed` in front of it everywhere.
bd090ef7 (v0.40.0)
moved it back to the front in `nvm.sh`'s `nvm_download`,
and then 6d870d18 (v0.40.5) began building those arguments with `set --`,
prepending `--compressed` after `-q`,
so whenever curl supports compression, `-q` was second again.
`nvm_get_latest` and `install.sh`'s `nvm_download` have passed
`--compressed` before `-q` since v0.33.2.

Pass `-q` first in all three places.
Settings in a user's `.curlrc`
(such as a proxy, CA bundle, or `write-out`)
no longer apply to nvm's own curl calls,
as was intended,
and as in v0.40.0 through v0.40.4 for `nvm_download`;
the corresponding environment variables
(eg, `https_proxy`, `CURL_CA_BUNDLE`) still apply.

The existing `nvm_get_latest` test pinned the old argument order,
so its expectation is updated

Discovered by Anthropic's OSS Scanner, as ANT-2026-DESJ2ESZ; the scanner reported it as a vulnerability, but it is not one.

test/slow/nvm_get_latest/nvm_get_latest

@@ -19,7 +19,7 @@ OLDPATH="$PATH"
 
 EXPECTED_VERSION="v12.3.456"
 URL="https://github.com/nvm-sh/nvm/releases/tag/$EXPECTED_VERSION"
-EXPECTED_CURL_ARGS="--compressed -q -w %{url_effective}\n -L -s -S https://latest.nvm.sh -o /dev/null"
+EXPECTED_CURL_ARGS="-q --compressed -w %{url_effective}\n -L -s -S https://latest.nvm.sh -o /dev/null"
 EXPECTED_WGET_ARGS="-q https://latest.nvm.sh --server-response -O /dev/null"
 export URL EXPECTED_CURL_ARGS EXPECTED_WGET_ARGS