Make package tarballs be in their own directory

This makes it harder to tarbomb a directory by accident.
Merge pull request #273 from NateEag/fix-package-tarbomb

Make package tarballs be in their own directory