Clean up filename escaping in export/archive

[finishes #81786576]

Here are the clean rules:

* In view, when creating link, give a filename that will:
  (a) not contain '/', '?' or '#' (so Play will route it properly)
  (b) not contain invalid filename characters (so the browser will
      download it properly)
* When generating Content-Disposition, give whatever the user asks for.
  If that leads to invalid filenames, we trust the user knows what to
  do, because the user requested a file via some means other than the
  link we generated.
* Don't use Play "*" parameters in conf/routes. They're wonky.