Bugfix: let* not let, to bind default-directory

The first let clause binds default-directory, but with a plain `let`
this isn't in the scope of the second clause using `vagrant-box-list`.