Hi, I think you would need to find a way to upload the attachment directly to sys_attachment table, and potentially you could create a record producer to do this. But I have not tested the impact of setting table_sys_id to be the sys_id of the same sys_attachment record (eg itself).
The url would simple be the URL of the attachment record, which would download the attachment if you navigated to it, or you may be able to leverage document viewer to open the attachment in your browser;
Document Viewer (servicenow.com)
You can create the url via script, as long as you have the sys_attachment records sys_id eg
var myURL = 'https://' + gs.getProperty('instance_name') + '.service-now.com/sys_attachment.do?sys_id=' + current.sys_id;
