Push DownloadBehavior authz to Ability

The purpose of this commit is to push the authorization embedded in Hydra::Controller::DownloadBehavior to the Ability class while maintaining backward compatibility.

See the commit message for details.