Extract archives in a separate directory from the input archive

[zorgiepoo]

Fixes #960 and may later help me work around #2544

This also fixes a vulnerability issue where an attacker could overwrite the input archive file since it resided in the same directory as the one being extracted into.

Misc Checklist

• My change requires a documentation update on Sparkle's website repository
• My change requires changes to generate_appcast, generate_keys, or sign_update

Testing

I tested and verified my change by using one or multiple of these methods:

• Sparkle Test App
• Unit Tests
• My own app
• Other (please specify)

Tested extracting app update with a test app from:

• zip files
• tar* files
• binary delta files
• dmg files (with Applications alias)
• archived pkg files
• bare pkg file
• generating new updates using generate_appcast works

macOS version tested: 14.4.1 (23E224)