PoC: Google Sans ligatures spoof in Download UI (and omnibar in some cases)

Based on https://crbug.com/391788835, applies to all ligatures.

Note: The "File can't be download securely" warning is only because we don't have a valid cert for HTTPS connection. This would not appear in a real attack.