Cannot figure out where the tmp folder is to add the .htaccess file per http://drupal.org/SA-CORE-2013-003
Maybe I don't fully understand where outside the root dir is at? Isn't it the directory above where the installation is at?  Is it in the html folder, the sites folder, or above the html folder?


The tmp folder is where your configuration says it is.

I looks like you've already navigated to Administration » Configuration » Media  » File system, and found that the field "Temporary directory" says /tmp - so that is where it is (this is also the default location).

Now, this is a file system path, not a Drupal path.  The "/" in front tells you it is in the file system root.

To navigate to it, use the following command in the Gnu/Linux CLI:

 cd /tmp



  Will the instructions in http://drupal.org/SA-CORE-2013-003 work if I create a tmp folder in the html folder?


No.


  Where exactly do I create the tmp directory?


You don't create it.  It should already exist on your system.

To fix the error message regarding the .htaccess in /tmp related to the security update you mention, do as follows:

First, in the GNU/Linux CLI, use the following two commands:

 cd /tmp
 rm .htaccess


Then in the Drupal GUI, as admin, navigate to Administration » Configuration » Media  » File system.  Do not change anything, but press "Save configuration".  This will make Drupal create the correct .htaccess in the right place.