rpmsign uses a predictable filename for temporary file(s), can leave them behind

[pmatilai]

Ran into this related to #3469: there appears to be a some path where --addsign/--resign leaves the temporary .sig file behind on failure. And because the name of the .sig file is formed from the package name by just appending .sig, any attempts to sign the same package again in the same location will fail because of that.

We shouldn't leave temporary files behind, period. And, we should use a non-predicatable name for it anyhow. The current method places the .sig file in the same directory as the package is in, so non-safe for world-writable directories in particular. /tmp is maybe not the place to sign your packages, but we could handle this better...