fix: safely handle Content-Disposition download filenames

[ryanduguid]

Summary

• parse quoted and RFC 2231 encoded Content-Disposition filenames with the standard-library MIME parser
• extract relative leaves using both POSIX and Windows separators
• reject absolute, drive, UNC, control, invalid and Windows-reserved names
• resolve and contain the final path under the configured temporary directory
• write through an already-open private temporary file and claim the requested leaf with an atomic same-directory hard link, preserving the random path if the name exists or the filesystem cannot make the link
• avoid name-based cleanup after a failed claim, so a concurrent replacement is never removed
• add adversarial traversal, encoded/quoted, malformed-header, reserved-name, control-character, regular-file preservation, injected race/replacement and symlink regressions

This SDK contains generated client code. The same hardening should also be carried into Xero's customised Python API-client template before the next regeneration.

Validation

• focused file-download suite on Windows: 19 passed
• fatal-error flake8 selection passed
• full Windows suite combined with the independent pre-epoch fix from fix: serialize epoch datetimes on Windows #242 and all nine Prism mocks: 196 passed
• standalone full Windows run: 186 passed and the known datetime.timestamp() pre-epoch failure fixed independently by fix: serialize epoch datetimes on Windows #242 remains
• git diff --check