[Fix] bash_completion: list alias and version names without expanding them

`__nvm_generate_completion` passed its word list to `compgen -W`,
which runs every word through shell expansion.
Since that list includes alias file names and installed version directory names,
pressing Tab after `nvm use`, `nvm alias`, etc,
ran any command substitution in those names,
expanded variables in them, and globbed `*` against the current directory.
Now the list is split with globbing disabled,
and each word is matched against the current word as a literal prefix,
so names are offered exactly as written

Discovered by Anthropic's OSS Scanner, as bug ANT-2026-QDARMGPO; the scanner correctly classified it as not a vulnerability.

bash_completion

@@ -8,9 +8,25 @@ fi
 
 __nvm_generate_completion() {
   declare current_word
+  declare word
+  declare glob_was_off
   current_word="${COMP_WORDS[COMP_CWORD]}"
-  # shellcheck disable=SC2207
-  COMPREPLY=($(compgen -W "$1" -- "${current_word}"))
+  # not `compgen -W`: it expands every word (including command substitution),
+  # and the words include alias and version directory names
+  COMPREPLY=()
+  glob_was_off=false
+  case $- in
+    *f*) glob_was_off=true ;;
+  esac
+  set -f
+  for word in $1; do
+    case "${word}" in
+      "${current_word}"*) COMPREPLY+=("${word}") ;;
+    esac
+  done
+  if [ "${glob_was_off}" = false ]; then
+    set +f
+  fi
   return 0
 }