state/apiserver: Return filename from Backup API

This change adds a Content-Disposition header to backup API responses which contains the server-generated backup filename. This becomes important once backups start being stored server side (soon) but also simplifies the client side of the backup API (no need to generate backup filenames).
I think the filename string needs to be escaped, in case there are special characters in it.