Security: Don't use a world-writable cache directory

A world-writable cache allows any process to hijack another user's
`brew install` session.  Move the cache to the repo dir, so that
modifying the cache requires the same permissions as modifying the
Homebrew installation itself.

We don't migrate the existing cache, because safely migrating the cache
would be tricky, and any mistake would probably be exploitable.

Closes #23232.