The iframe-based get_file has always been problematic to debug & to handle errors in. The latest issue is #24854 trying to intercept and handle HTTP 504 Gateway Timeout responses, and doing so by matching the textual content of the response document somehow as the status code is not available when loading stuff in an iframe (which feels *extremely* brittle as it basically assumes an nginx working in an english locale returning a default/non-customised error page).

Looking up recent-ish web APIs it turns out we can implement file download without the iframe hack using [XMLHttpRequest extensions](https://caniuse.com/#feat=xhr2), [FileReader](https://caniuse.com/#feat=filereader) to replicate the error handling and either HTML5 a[download], proprietary APIs or browsing data URI to trigger the actual save/save as dialog.

Aside from the various download bits/fallbacks, the main sources of complexity are parsing the `Content-Disposition` header to get the "best" filename we can (delegated to a library because it's decidedly non-trivial) and replicating the old error handling scheme for compatibility purposes.

Tested in Chrome, Firefox, Safari, IE11 and Edge desktop (though not in depth for the latter 2) as well as Safari/iOS and Android.

The main source of interrogation is the error handling as it's not quite clear how to exercise it.