always use a temporary directory when downloading files and replies

[cfm]

Description

Rather than defaulting to either ~/QubesIncoming or ~/Downloads or taking an explicit path only under test, API.download_{reply,submission}() should always save a file to a temporary directory provided by the caller.

How will this impact SecureDrop users?

No user-facing impact.

How would this affect the SecureDrop Workstation threat model?

No threat-model implications.

[cfm]

One reason to make this change is so that the branch (code-path) we test is actually the branch we care about, as demonstrated by the test-level changes in 18e19c3.