download: only take basename of 'filename' when the latter is used to calculate destination path

Currently only useful for buildout.hash.cfg files in
https://lab.nexedi.com/nexedi/slapos (e.g. software/slaprunner)