Implement atomic save

Ping @fperez, this should avoid issues with corrupted/lost notebooks when the disk is full, though I haven't worked out how to test it just yet.

Closes gh-6254
Want to check that `tmp_file` exist ? 

Also do you want add docstring especially the warning that this will break hardlinks as the file inode changes ?