Handle the "attachment" Content-Disposition.

* This forces downloading files, even if the browser would be able to
show them directly.
* Fixes #10989.