I faced a similar problem sometime ago. You will not be able to download the file using a GET request using href attribute as u mentioned in the question.
Instead you can submit a form embedded in an iframe as suggested here and submit the form with your file id as a hidden element and it should trigger the download. So your anchor tag shall be:
<a href="javascript:void(0)" onclick="downloadFile('+fileId+')">download</a>
Now pass your fileId as parameter to the onclick JS function and define it like this:
 function downloadFile(fileId) {
    let $iframe, iframeDoc, iframeHtml;
    if(($iframe = $('#download_frame')).length === 0) {
    $iframe = $('<iframe id="download_frame" +
                ' style="display: none;" src="about:blank"></iframe>'
               ).appendTo('body');
    }
    iframeDoc= $iframe[0].contentWindow;
    if (iframeDoc.document) {
     iframeDoc= iframeDoc.document;
    }
    iframeHtml= '<html><head></head><body><form method="POST" action="http:localhost:8080/MyProject/downloadAction.action"><input type="hidden" name="fileId" value="'+fileId+'"></form></body></html>'; 
    iframeDoc.open();
    iframeDoc.write(iframeHtml);
    $(iframeDoc).find('form').submit();
}
You can follow similar approach for single or multiple files.
Also to add you can include this in ur web.xml in the filter configuration:
    <init-param>
        <param-name>cors.allowed.headers</param-name>
        <param-value>Content-Type,X-Requested-With,accept,Origin,Access-Control-Request-Method,Access-Control-Request-Headers,X-Test-Header,Cache-Control
        </param-value>
    </init-param>
    <init-param>
        <param-name>cors.exposed.headers</param-name>
        <param-value>Access-Control-Allow-Origin,Access-Control-Allow-Credentials
        </param-value>
    </init-param>