TST: remove insecure mktemp use in tests

mktemp only returns a filename, a malicous user could replace it before
it gets used.