stbt.OcrMode: Add docstring with link to Tesseract manual
stbt.ocr: Use $XDG_RUNTIME_DIR and mkstemp for temporary files

On systems that support it, `$XDG_RUNTIME_DIR` is likely to be a tmpfs
(which is more appropriate for these short-lived files) and unlike
`/tmp` is only readable/writable by the user. On systems that don't set
`$XDG_RUNTIME_DIR`, we just use `mkstemp`'s default (the standard Unix
`$TMPDIR`). See the XDG Base Directory Specification:
http://standards.freedesktop.org/basedir-spec/basedir-spec-latest.html

`mktemp` is deprecated, though I'm not convinced that, in this
particular scenario, `mkstemp` is any more secure: We don't pass a
filehandle to tesseract, we pass the file *name*, so an attacker could
still overwrite the temporary file after it was created my `mkstemp` but
before tesseract reads from / writes to it. I suppose that the benefit
of `mkstemp` in this case is to avoid a race conditions where 2
processes calling `mktemp` at the same time could get the same filename
back (though I imagine that this is very unlikely).