Use github.com/google/renameio for atomic file updates

This also fixes a very unlikely race condition which could delete a
temporary file from a concurrent nsscash run if it chooses the same
temporary file name after os.Rename() was called but before our deferred
os.Remove() remove it. This race would cause the second nsscash run to
fail but not cause any corruption of persistent files.