Add curl on subshell to curl-pipe-bash rule

[JacobBrackett]

This is another common pattern untrusted URLs are downloaded and exec-d without verification

[CLAassistant]

All committers have signed the CLA.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}