state/apiserver: Return filename from Backup API

This change adds a Content-Disposition header to backup API responses which contains the server-generated backup filename. This becomes important once backups start being stored server side (soon) but also simplifies the client side of the backup API (no need to generate backup filenames).
I did look into encoding the filename but it turns out there's no generally accepted way of doing this. Given that we control the filename I think it's best to keep things simple and not bother with encoding. 

I'll add a unit test for the function that generates the backup filename to ensure it only uses 7-bit ASCII and doesn't contain quotes.

Lots of gory detail here:
http://stackoverflow.com/questions/93551/how-to-encode-the-filename-parameter-of-content-disposition-header-in-http