bootstrap: Share tarballs between worktrees
If we're in a linked worktree, use tarballs from the main worktree's
BUILD directory if we can to avoid downloading files we already have,
and if we have to download a tarball save it in the main worktree's
BUILD directory so it can be used by other worktrees.
To avoid race-type problems with another process using a tarball between
download and signature checking we now download to a "quarantined"
temporary filename and check the hash of that, and only rename to the
final name if that check succeeds (which is a better approach anyway).