fixes for the attachment file URI

- use `URI::path_segments` to get filename of ItemAttachment instead of
  using `file()->basename`
- no need to `uri_escape()` the filename inside `url_for()`