Download to unique temporary file, only move once downloaded

This fixes #94 and #99 by downloading the file to a unique path and only writing it to the canonical path (shared by multiple concurrent or subsequent runs of npm install for this package) once it is fully downloaded.

Please review and let me know if you have any extra requirements around this fix, thanks!