Implement atomic save

Ping @fperez, this should avoid issues with corrupted/lost notebooks when the disk is full, though I haven't worked out how to test it just yet.

Closes gh-6254
I don't think it's worth the trouble - this should already fix the issue we saw with running out of disk space, even on Windows. The only scenario I can see where this would fail is if the write succeeds, it deletes the target file, and then another process creates a file with the same name before it can do the rename operation. In that bizarre case, the temporary file should be left around, so the data is still there.

If we did want to do that, I think [MoveFileEx] is the function we'd need, rather than CopyFile. Anything that copies a file suffers from the same problem - it may run out of space while writing a file.