avoid symlink attacks in __fish_print_packages

 * use $XDG_CACHE_HOME for __fish_print_packages completion caches

Fix for CVE-2014-3219.

Closes #1440.