Use tempfile.mkdtemp to avoid tempfile race

Malicious users could predict these tempfile names and overwrite root
owned files using a symlink attack.

Also fixes a bug in order of operations which caused tar to fail if
the destination directory did not exist yet.

Fixes bug #1166323

Change-Id: Ib4040eed27aa7e1e4d2bf53df6cae8e2b6c95f50