I was trying to do something exactly like this a few months ago, but I found that browsers' extension APIs have no way to access files after download. You'd have to intercept a download and manage it entirely in the extension, which will likely break so many JS-driven downloads as to be very bothersome.

Alternatively you would have to install a local helper process outside the browser, and at that point, you're basically an antivirus. In fact, I think AVs are the ones better placed to add this as a feature, as well as already having the significant resources needed to maintain a secure archive of hashes for files (although I had thought up a signature-based scheme that software vendors/distributors could adopt for a small fee).

Yes, this has been discussed. It has to be done carefully so that it doesn't leak every URL you download, but if done well I think it would be useful.

Double hash the url and check if it's in the database: if not, prompt the user if you want to upload the actual url.

I believe that double-hashing is "equivalent" to single-hashing. See this issue: https://github.com/ipfs/refs-denylists-dmca/issues/2

There are some ways of doing it, depending on exactly what your threat model is, but I think it's risky in general. Right now this is just in the planning stages, but I want to have submitting URLs be a manual button click for each download, and also provide an option to use a local copy of the database (so that all lookups would be completely private).