cmake: Fix dependency download logic

Previously, if download failure occurred or interrupted by Ctrl-C, the
broken file is not removed. This is true for the first case because
"message(FATAL_ERROR ..." stops cmake and "file(REMOVE ..." is never
reached. After that, if cmake is run second time, SHA256 verification is
skipped and the broken file will be used.

This patch fixes this by using a temporary intermediate file. The file
data is downloaded into a temporary file first, then the temporary file
is atomically renamed to destination.

Error checking of download status is also improved. The if clause now
checks error code against zero more strictly, according to cmake's
documentation.