fr:attachment: use download attribute

[ebruchez]

This instead of using target="_blank" ("as of 2009-05, seems to be how most sites handle this").

• add download attribute
• add dynamic download filename value

The filename attribute is necessary in the JavaScript environment, as there we don't proxy and so we cannot add a Content-Disposition header.

<xf:output appearance="xxf:download"> already supports a nested <xf:filename>, but that is only used for proxying. We need to make use of this to produce the dynamic filename attribute.