FIX Only block root vendor folder

Use RewriteRule instead to take in account any subfolder via RewriteBase. Deny ss-cache and composer via RewriteRule too.
Merge pull request #1786 from colymba/3.0-htaccess-fix

vendor folder is blocked only if outside themes