A few things happened here. I split out the access-checking logic into a
FillPdfAccessHelper service. In coordination with that, I added
FillPdfLinkManipulator::parseUrlString() to facilitate parsing the
context strings we store in FillPdfFileContext objects. I also changed
the way I store URLs in FillPdfFileContext.context so that they are
easier to pass to Url::fromUri() for parsing (and I made a helper
method that parses them into a form Uri::fromUri() likes).

In short, saving PDFs to files now works as well as downloading. Score!

This is the same concept as the fillpdf_file_context table in D7. It
lets the module
store generation info for generated PDFs so that private storage access
checking
can work properly. I'll be simplifying this a lot in D8 and simply
storing a
URL that I can parse to get the entities whose access needs to be
checked. And
I might backport that to D7; it's much simpler.