Fix predictable /tmp path enabling symlink attack as root

fix-opera.sh runs as root and used a fixed, world-guessable temp
directory (/tmp/opera-fix) created with `mkdir -p`, which succeeds
silently even if the path already exists. A local unprivileged user
could pre-create /tmp/opera-fix as a symlink to a directory they
control and place a malicious libffmpeg.so/libwidevinecdm.so there
ahead of time. When an admin later ran this script, root would copy
the attacker's library into Opera's lib_extra with 0644 perms, where
it gets loaded into every user's browser process on the system.

Switch to `mktemp -d`, which atomically creates a private (0700),
unpredictably-named directory via a bare mkdir() syscall - exclusive
by nature, so it can never adopt a pre-existing path or symlink the
way `mkdir -p` does. Also drop the now-redundant mkdir -p call, since
mktemp already creates the directory.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

scripts/fix-opera.sh

@@ -31,7 +31,12 @@ fi
 
 #Config section
 readonly FIX_WIDEVINE=true
-readonly FIX_DIR='/tmp/opera-fix'
+FIX_DIR=$(mktemp -d -t opera-fix.XXXXXXXX)
+if [[ ! -d "$FIX_DIR" ]]; then
+	printf 'Failed to create a secure temporary directory\n'
+	exit 1
+fi
+readonly FIX_DIR
 readonly FFMPEG_SRC_MAIN='https://api.github.com/repos/Ld-Hagen/nwjs-ffmpeg-prebuilt/releases'
 readonly FFMPEG_SRC_ALT='https://api.github.com/repos/Ld-Hagen/fix-opera-linux-ffmpeg-widevine/releases'
 readonly WIDEVINE_SRC='https://raw.githubusercontent.com/mozilla-firefox/firefox/refs/heads/main/toolkit/content/gmp-sources/widevinecdm.json'
@@ -121,7 +126,6 @@ if $FIX_WIDEVINE; then
 fi
 
 #Downloading Widevine
-mkdir -p "$FIX_DIR"
 if $FIX_WIDEVINE; then
   printf 'Downloading Widevine CDM...\n'
   echo -e "From URL: $WIDEVINE_URL\n"