Updater seems to use `%APPDATA%` even when the user folder is explicitly redirected via `BN_USER_DIRECTORY`

[whitequark]

Version and Platform (required):

• Binary Ninja Version: 4.1.5261-dev Personal (859dedd4)
• OS: Windows
• OS Version: 10
• CPU Architecture: x64

Bug Description: I'm using BN on a machine with roaming profiles enabled. BN breaks in somewhat weird ways; most notably the updater doesn't seem to be able to handle UNC paths. Fixing it to handle those would be acceptable, but equally acceptable would be to teach it to actually put stuff in BN_USER_DIRECTORY; it seems like one part of the updater respects the latter and the other puts it in %APPDATA%.

Steps To Reproduce:

1. Set BN_USER_DIRECTORY to something not under %APPDATA%
2. Try to change update channel settings

Expected Behavior: Updater does not write to paths under %APPDATA%

Screenshots: The console contains

[Default] Error changing update settings: Unable to write to cache (object manifest)

Also procmon shows that it tries to write to a directory under %APPDATA% despite an explicit redirect: