How can we add password protection for downloaded files?
Well, you need to use Aspose.Cells library for the purpose as Aspose.Cells.GridWeb (Java) does not support the feature, see the document for your reference: Encrypting Excel Files
Why the files get downloaded in bin folder for tomcat?
Well, the question is not related to Aspose.Cells or Aspose.Cells.GridWeb (JAVA) APIs. You should browse internet for it or post your query into the respective forums. For example, you may see the thread for your referencce:
How to download as PDF version
You may again use Aspose.Cells component for converting Excel workbook to PDF, see the document for your reference.