deposit: updates to arXiv fulltext task

* Updates the arXiv automatic fulltext downloader with various
  fixes and enhancements:

* Moves the download task in the workflow to after user confirmation
  to avoid users to wait for the download in the background.

* Fixes an exception if there was one file attached already
  (then metadata["fft"] is not a list but a dict).

* Hardcodes the filename to be equal to "1234.1234.pdf" to be
  consistent with user file upload names.

* Removes the call to secure_filename as this is anyway called
  in DepositionFile.

Signed-off-by: Jan Aage Lavik <jan.age.lavik@cern.ch>