how to prevent unsetting ReadOnly flag of a file using java?

I've created a servlet to let users download a file.

That servlet will be running on the web server. It's not running on the user's local computer - so it can't change anything about the user's local file system. Even your downloadFile.setWritable(false) won't operate on the user's local file system - the file will be saved by the browser, and the user gets to do whatever they want with it.

Even if you are running some app separately to your service, it would be not only hard, but pretty unfriendly to create a file which the user couldn't touch on their own system. You could try to run your app as a separate user, and give appropriate permissions to both the file and the directory it runs in - but then if the user has access to an administrator account, they'd still be able to override that.