Oy veh! This is a case where hairdressers might write the less frightening code, using curlies:

s{/[^/]*/+\.{2}/}{/}g;
[download]

(also switched to using positive-lookahead to check for the final "/" in the pattern, so as to avoid the need for a loop; and just in case the input is "goofy but functional", ala "/one/two//../three", I added "+").

(Update: never mind what I said about positive-lookahead. There seems to be no way to avoid using a loop to make this "work", so no point using "(?=/)" as the last part of the match. This was never intended as a serious solution anyway, given the issues discussed in other replies.)