rollback when failing to buildout

Whenever a buildout to update an installation fails, the current installation becomes corrupt. This is not optimal. Ideally buildout runs all the downloads/installations into a safe directory and only after that was successful it moves everything over into the real installation. If the installation can only be done into the real directory, at least the downloads should be 'safe'. Eg. download before uninstalling/changing/overwriting anything.