core: Protect GetAttachmentServlet from response splitting attack

Current version of GetAttachmentServlet inserts given filename directly to http
response header, which allows code splitting.
This patch fixes it by url-encoding the given filename.

Change-Id: I90dd7d95879342d70cfbb43c49d128457aebc35e
Signed-off-by: Frantisek Kobzik <fkobzik@redhat.com>
Bug-Url: https://bugzilla.redhat.com/show_bug.cgi?id=843410