This is indeed possible with nginx-lua; in particular, the header_filter_by_lua directive.
Something like the following ought to do the trick:
location / {
header_filter_by_lua '
local args = ngx.req.get_uri_args()
if not args.f then return end
ngx.header["Content-Disposition"] = "attachment; filename=" .. args.f
';
}