chore(bidi): fix support for downloads

[hbenl]

This PR:

• uses the suggestedFilename for downloads with Bidi
• uses resolveWithinRoot() instead of path.join() in the Download constructor to ensure downloads can't escape the download folder

Fixes #40513 and the following tests:

• library/browsertype-connect.spec.ts:
  • "launchServer > should save download"
  • "run-server > should save download"
• library/defaultbrowsercontext-1.spec.ts:
  • "should support acceptDownloads option"
• library/download.spec.ts:
  • "download event > should report download when navigation turns into download"
  • "download event > should work with Cross-Origin-Opener-Policy"
  • "download event > should report downloads with acceptDownloads: true"
  • "download event > should report downloads for download attribute"
  • "download event > should save to user-specified path without updating original path"
  • "download event > should save to two different paths with multiple saveAs calls"
  • "download event > should save to overwritten filepath"
  • "download event > should create subdirectories when saving to non-existent user-specified path"
  • "download event > should report non-navigation downloads"
  • "download event > should report download path within page.on('download', …) handler for Files"
  • "download event > should delete file"
  • "download event > should expose stream"
  • "download event > should delete downloads on context destruction"
  • "download event > should delete downloads on browser gone"
  • "download event > should download large binary.zip"
  • "download event > should not fail explicitly to cancel a download even if that is already finished"
  • "download event > should report downloads with interception"
  • "download event > should emit download event from nested iframes"
  • "should be able to download a PDF file"
  • "should be able to download a inline PDF file via response interception"
  • "should save to user-specified path"
• library/downloads-path.spec.ts:
  • "downloads path > should delete downloads when context closes"
  • "downloads path > should delete downloads when persistent context closes"

[github-actions]

Test results for "MCP"

2 failed
❌ [chromium] › mcp/http.spec.ts:103 › http transport browser lifecycle (isolated) @mcp-windows-latest-chromium
❌ [chromium] › mcp/http.spec.ts:142 › http transport browser sigint @mcp-windows-latest-chromium

6941 passed, 1052 skipped

---

Merge workflow run.

[github-actions]

Test results for "tests 1"

1 failed
❌ [firefox-page] › page/page-emulate-media.spec.ts:196 › should report hover and fine pointer for desktop @firefox-ubuntu-22.04-node20

2 flaky

⚠️ [chromium-library] › library/video.spec.ts:719 › screencast › should work with video+trace `@chromium-ubuntu-22.04-arm-node20`
⚠️ [webkit-page] › page/page-set-input-files.spec.ts:297 › should detect mime type `@webkit-ubuntu-22.04-node20`

41659 passed, 851 skipped

---

Merge workflow run.