trust anchors: use parallel-safe temporary name

Previously multiple kresd processes might use the same .lock file at
once and thus have a race between writing and renaming.  That could
happen relatively often if starting many instances *at once*.
24 jobs for ta-parallel
in 62 minutes and 24 seconds and was queued for 5 seconds