Sanitize downloaded filenames to prevent arbitrary overwrite