It sounds like you want to store the file in Drupal's private file system. There is no need for a module - this is in core.
Files that are in the private system will:
Be protected from access by Drupal's core access control system. If the user don't have access to the page where the file field is attached, he/she will not have access to the file.
The URL ...
A taxonomy field is referencing entities, it has no value property. See how to print value of a taxonomy field to headline with node.html.twig?
Converting this to a token pattern:
You can search for examples for each of your questions with "backwards views" and "sibling views". In short:
Show children on parent page
Create a Views that lists Children, then add the Entity reference field as the Contextual filter (not Content ID). Configure it to Provide default value Content ID from URL.
No Relationships needed in ...
Since Drupal 8.8.0, the path.alias_manager has been deprecated in favor of the new service path_alias.manager (see the change record.)
Accordingly, you can get the current path alias this way:
$current_path = \Drupal::service('path.current')->getPath();
$alias = \Drupal::service('path_alias.manager')->getAliasByPath($current_path);