Always remove the jsessionid parameter from the downloaded file name

Steps to reproduce the bug:

1. enable anonymous authentication
2. create a document with an attached file
3. get the document permalink
4. open a new browser and paste the document link
5. observe that the URL for the main attachment contains the jsessionid with something like http://localhost:8080/nuxeo/nxfile/default/681a569b-91ea-4b3a-9852-3fc83f3867a6/blobholder:0/myfile-1.3.4.zip;jsessionid=90810978894678364. Then the downloaded file name will be myfile-1.3.4.zip;jsessionid=90810978894678364 instead of myfile-1.3.4.zip

The download servlet should always clean the file name to remove the jsessionid parameter.