Avoid cross device activity for box creation

This will cause issues on modern linux which uses a tmpfs-backed tmpdir.

This moves the temporary box creation to the same directory tree as the provider's directory.  This is an alternate solution to pull request #1199, and will not incur the speed penalty involved in a cross-filesystem mv, assuming a box provider's directory is one filesystem.  A better solution I suppose would be to test if /tmp is cross device first, but that adds more complexity for questionable benefit, I think.