Enable ACL-restricted file download through one-time links

From nexus-kg created by [mdupont](https://github.com/mdupont) : BlueBrain/nexus-kg#303

# Use case
An instance has an attachment and it is not publicly accessible. In order to be able to download the file, it is currently necessary to send a HTTP GET request to the downloadUrl with the HTTP Authorization header containing the access token.

**Problem:** using a browser, it is not possible to add the Authorization header when navigating to the downloadUrl, and when using the Fetch API it is possible to add the header but not to trigger a file download. Workarounds are available (see below) but have limitations or drastically increase the complexity of implementing a file download solution.

**Current workarounds (not ideal):** Using the Fetch API, store the result as a Blob in memory (RAM limited!), then convert the Blob to an Object URL, build a DOM element containing the encoded binary data in a way allowing to download it (approach of https://github.com/eligrey/FileSaver.js ). Or emulate content streaming by creating a stub server using serviceWorkers and messages (approach of https://github.com/jimmywarting/StreamSaver.js )

# Proposed solution
Introduce temporary, one-time download links that allow downloading non-public files through a simple HTTP GET request without additional headers.

Start by tracing how the downloadUrl handles HTTP GET requests and Authorization for ACL-restricted attachments. The issue provides no file or test entry point; done means a temporary, one-time link can download a non-public file through a simple GET without an additional authorization header.

Written by the indexing model from the issue text.