File download API security tweak.

refs #5841

Converted the download path to a real path before checking if
it's within the Archivematica directory tree.