better filename parsing

The filename found in the URL will be used for old plugins missing a
base entry in their plugin.info.txt and lacking a subdirectory inside
the archive as well. This patch makes sure possible query strings aren't
included in the filename.

Note: io_download() will also try to get a filename from any
content-disposition header.

If no filename can be found we simply use an md5 sum of the URL and hope
the plugin will contain it's own hint for naming.