Avoid serializing to string

Summary:
saveXml() serializes to a string which instantly doubles the memory
usage. Since the DOMDocument API doesn't allow us to write to the
php://temp stream we write to a temporary file instead.

Differential Revision: https://git.kolab.org/D1240