Download tarballs to a sane location, rather than a garbage filename in .tmp.

To do this, whenever a tarball is added to the install list from a package@version thing, put it in a list so that I know which tarball url is related to which package.

Then, if the tarball contains a package that doesn't match the expected package@version, we can fail, and it can be moved/unpacked to a sane spot.