Moved the `tmp/` path into the config (was hardcoded everywhere)

**This PR is based on #6648**

The `tmp/` path was hardcoded everywhere, which resulted in using `SettingsPiwik::rewriteTmpPathWithInstanceId()` to rewrite it for specific use cases. This is risky as developers have to remind to call this "rewrite" method everytime (and in some place it wasn't…), and it makes everything not really customizable (`rewriteTmpPathWithInstanceId()` had to be added so that for "multiple piwik instances scenarios" we could customize the path with an "instance ID"…).

I've moved the `tmp/` path into the config, and replaced all hardcoded usage (and calls to `rewriteTmpPathWithInstanceId()`) by a `get()` from the container.

Getting entries from the container is a bad practice and dependency injection should be preferred, but we do baby steps. When refactoring those classes to DI, we'll replace calls to the container with proper dependency injection.
Another thing we'll need to do too is move the hardcoded *sub-path* of `tmp/` (e.g. `tmp/sessions/`) into the config also (but again: baby steps).

Another future step might be to remove completely instance ID and let it be handled by a plugin (or by end-user config). Having the `tmp/` path in the config means that plugins or users can override it and be assured that it will be taken into account everywhere in Piwik.
is this change expected in the PR?