examples: defend from privilege elevation

[KoyamaSohei]

fix: #3992 (comment)

[dougwilson]

So I noticed the fix for this was to switch from res.download to attachment + sendFile. That does indeed work, but I think it exposes that the res.download API doesn't actually make it easy to use it i. This way, which I think we should actually improve/fix in some way.

[dougwilson]

Ok, Sorry for the delay. I dug in to this today and so what I found was that this was an oversight when the full options support was added to res.download -- this is a bug it'll be fixed such that the root option is honored when supplied. This bug fix will land in the next minor, 4.18, since it's a bit more risky of a fix depending on what folks are passing in. I updated the example to resolve the path to absolute and still use res.download, as I looked in to it and this example's purpose was to demo res.download among other APIs, so this'll land now.