core download: remove duplicate code for creating the directory
core download: refactor curl + tar into a single command string
core command: "use WP_CLI\Utils;"
rename create_cmd() to esc_cmd()

Matches WP escaping functions: esc_sql(), esc_html() etc.