Fix CVE from bug #331

Here is a patch set that does two things:

1. Adds a common/utils.c with a string_concat() function.  This is to avoid chains of strcat(), which is unsafe and O(n^2).

2. Falls back to getpwuid_r() if neither HOME nor XDG_CONFIG_HOME are set.  This removes the possibility of a symlink attack in /tmp when libimobiledevice is being run as root.