`NamedTemporaryFile` turns out to lock the file on Windows, preventing
`os.replace` from moving it:
```
windows> bazel run --enable_runfiles //[redacted]:install -- --destdir=d:\est
[...]
INFO: Running command line: [redacted]/install.exe <args omitted>
INFO: Installing to [redacted]
Traceback (most recent call last):
  File "[redacted]\install_install_script.py", line 92, in _do_file_copy
    os.replace(tmp_file.name, dest)
PermissionError: [WinError 32] The process cannot access the file because it is being used by another process: '[redacted]\\tmp4wd6gg1t' -> 'd:\est/filename.ext'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "[redacted]\install_install_script.py", line 307, in <module>
    sys.exit(main(sys.argv))
             ^^^^^^^^^^^^^^
  File "[redacted]\install_install_script.py", line 303, in main
    installer.do_the_thing()
  File "[redacted]\install_install_script.py", line 206, in do_the_thing
    self._install_file(entry)
  File "[redacted]\install_install_script.py", line 126, in _install_file
    self._do_file_copy(entry.src, entry.dest)
  File "[redacted]\install_install_script.py", line 94, in _do_file_copy
    pathlib.Path(tmp_file.name).unlink(missing_ok=True)
  File "[redacted]\rules_python++python+python_3_12_x86_64-pc-windows-msvc\Lib\pathlib.py", line 1342, in unlink
    os.unlink(self)
PermissionError: [WinError 32] The process cannot access the file because it is being used by another process: '[redacted]\\tmp4wd6gg1t'

Intuition: _Any problem in computer science can be solved with another
level of indirection._ (https://bwlampson.site/Slides/TuringLecture.htm)

The change therefore proposes to use `TemporaryDirectory` instead of
`NamedTemporaryFile` as an indirection to avoid a file lock from being
held, which allows the file to be freely written and moved on all
platforms while maintaining the same atomic replace behavior for macOS
code-signed binaries introduced in commit
31cab20 (bazelbuild#941).