You can't. That part is entirely done by the browser.
GWT can't fix this, and it will NEVER become part of webbrowsers.
Ever. The moment I can traverse your local filesystem's directories is
the moment I will scan your entire disk for your passwords in the
background. It's a fundamental security risk that browsers won't ever
have. Or if they do, it'll be big news and that browser's author will
scramble to close that hole and push out a patch ASAP.
Create the XML file on the server (or push it to the server), then
have a 'download' link, which is served up with the mime type
"application/force-download" (ugly, but that works). When users click
it, the browser will open the save as dialog.
It's impossible to save a data stream you have on the client (in GWT
code) to the user's disk without server involved. This bit might
eventually be addressed by web browser authors, but it's not on the
horizon (read: in the proposed specs for HTML5), so don't hold your
breath.