Token should only include the URL so it works within non-HTML contexts
like emails. HTML contexts can simply use the token in an href attribute
of an anchor tag.

Moved saving the protected download entity back to an implementation of
`hook_webform_submission_insert()`, because the entity needs creating
before any tokens would be replaced, such as for email handlers which
may be invoked before our own handler.