/var/vm/sleepimage is used to store the contents of the RAM during hibernation, and the hybrid hibernation and sleep mode that Mac laptops use by default. If you have 8 GiB of RAM, /var/vm/sleepimage takes about 8 GiB of disk space. I don't know why it isn't deleted after waking up from sleep though. It might be to ensure that there is enough free disk space for it or so that it won't be stored on non-contiguous blocks if disk space is low.
You can delete /var/vm/sleepimage safely, but it will be recreated when you put the Mac to sleep. If you run sudo pmset -a hibernatemode 0; sudo rm /var/vm/sleepimage, the Mac will use a normal sleep mode (like desktop Macs by default) and it won't recreate /var/vm/sleepimage.
From man pmset:
hibernatemode = 0 (binary 0000) by default on supported desktops. The system will not back memory up to persistent storage. The system must wake from the contents of memory; the system will lose context on power loss. This is, historically, plain old sleep.
hibernatemode = 3 (binary 0011) by default on supported portables. The system will store a copy of memory to persistent storage (the disk), and will power memory during sleep. The system will wake from memory, unless a power loss forces it to restore from disk image.
hibernatemode = 25 (binary 0001 1001) is only settable via pmset. The system will store a copy of memory to persistent storage (the disk), and will remove power to memory. The system will restore from disk image. If you want "hibernation" - slower sleeps, slower wakes, and better battery life, you should use this setting.
- 0 (traditional sleep mode) enables fast wake up and sleep, saves disk space, and reduces writing to the drive.
- 3 (hybrid hibernation and safe sleep mode) enables fast wake up and sleep and enables restoring state after a power loss.
- 25 (hibernation) saves energy and enables restoring state after a power loss.
I used hibernatemode 0 with my MacBook Air. Even if the MacBook Air went to sleep when the battery was nearly empty, the battery didn't usually drain out completely during sleep. /var/vm/sleepimage took about 4 GiB of disk space, and writing it hundreds or thousands of times might have reduced the lifespan of the SSD.
It's a bit messy, and there is a degree of cross-overs, but the quick tour, without really going into the subfolders of these:
/etc, /tmp and /var are just symbolic links to subfolders in /private.
/etc generally contains configuration files.
/tmp is for temporary files used by running processes (also see /var/tmp)
/var is also used for somewhat temporary files used by running processes, but these tend to be less temporary and more often preserved between runs - e.g. logfiles which are usually in /var/log.
/usr contains binaries (executables) and developer-related files for core unix/BSD utilities. Things the user installs themselves should end up in /usr/local.
/bin also contains binaries but they tend to be more OS-fundamental than those in /usr - such as cp, cat, bash.
/sbin is as above but focused on routine administrative tasks such as mount and shutdown. The s=system/superuser, usually you need root/superuser rights to use these commands.
/.fseventsd is used by the OS to log file-system change events (such as folder creation) so that interested parties can be notified when the filesystem changes.
However, to run the risk of saying what you didn't want me to say - most of these are of little interest, and if you were to use any, you'd be most likely to be in /usr/local, /var/log or /tmp.
Additional information with a focus on the common Unix structure can be found on Wikipedia (Unix File System).
Best Answer
It's system-wide cache of Certificate Revocation Lists (CRLs). I think Safari puts its cache there, that's why you see it's being updated.