Do not store credentials in PUB_CACHE

[jonasfj]

The PUB_CACHE folder is something that it makes sense to cache in CI, so storing credentials in PUB_CACHE/credentials.json might not be ideal.

On windows we prefer to use a non-roaming folder for PUB_CACHE, but configuration options such as credentials.json should probably be roaming with the user profile.

See also: dart-lang/sdk#41560

[jonasfj]

I'm not 100% sure about Windows and Mac OS. But it looks like what other people are doing. Not sure if it should be roaming on Windows, and it seems using XDG on Mac OS might not be so crazy.

• On Linux (see XDG specification)
  • If $XDG_CONFIG_HOME is defined:
    • $XDG_CONFIG_HOME/dart/pub-credentials.json
    • $XDG_CONFIG_HOME/dart/pub-tokens.json
  • else
    • $HOME/.config/dart/pub-credentials.json
    • $HOME/.config/dart/pub-tokens.json
• On Mac OS (see developer.apple.com):
  • ~/Library/Application Support/dart/pub-credentials.json
  • ~/Library/Application Support/dart/pub-tokens.json
• On Windows: (or maybe %LOCALAPPDATA% is better)
  • %APPDATA%/dart/pub-credentials.json
  • %APPDATA%/dart/pub-tokens.json

Feedback / input is welcome from people lots of experience on these platforms.

[jonasfj]

Counter argument do like dartdev does and store it in ~/.dart/, as determined in:
https://github.com/dart-lang/sdk/blob/5caa4365d75a82ba2f3a702c5f426a719256f9de/pkg/dartdev/lib/src/analytics.dart#L97-L110

This is messy, and IMO we should clean it up. But until we do, perhaps it's better to just expand the mess rather than storing files in more locations.