Moved downloaded pk3s to a download/ folder

Also prevented QVM loading from a downloaded PK3. This prevents any possible QVM-related exploits.