window-commands: download web app icons into tmpdir, not xdg-downloads

In !1400 (merged) we removed the code that caused the web app icon to be downloaded to a temporary location. That was important. We don't want them showing up in the user's downloads directory.

To make this work, we'll need to stop using the URL of the icon as the filename, since it's expected to contain directory separator characters.

Fixes #2297 (closed)