core download --no-extract: unsafe archive names since #355 #356

#355 changed the name under which wp core download --no-extract saves the archive. Two parts of that need correcting before the next release:

• For URL downloads, the archive is now named after the last part of the URL, including its extension. The person providing the URL thereby chooses the name and type of a file written into the target directory, which is usually a web root, and can replace existing files there when --force is used. Before Name the archive of core download --no-extract after the release #355, URL downloads were saved under a random name with the extension detected from the archive, and they should be again.
• The archive is copied to a predictable name, and the copy follows a symlink at that path. Someone who can write to the target directory can thereby make the download overwrite a file elsewhere. This already applied to archives taken from the cache before Name the archive of core download --no-extract after the release #355, which extended it to fresh downloads. The archive should be written in a way that replaces whatever is at the destination instead of writing through it.

Neither is part of a release yet.