pkg_fetch_file now takes a mkstemp(3) pattern

while here fix pkg_fetch_file_to_fd when a repo is not set
this fixed pkg audit -F when a previously interrupted fetch has happened