Log Message:
Split bootstrap into two phases:
- phase one builds the essential tools in the bare minimal version
  needed by the infrastructure to run "make install".
- phase two runs "make install" for all the bootstrap packages.

Set WRKOBJDIR for the second phase, we never want to leave garbage
around.

This increases the time for running bootstrap, but gives more
deterministic results. It also means that e.g. configuration files
in pkg_install can be handled normally. It is a prerequirement to
sanely allow pkg_install some more extended work like building
its own libarchive without having to worry too much about limitations
on some platforms.

This fixes the expansion of @gzcat@ in the download-vulnerability-list
script.

Tested by tnn@ on Interix and myself on DragonFly.