Fix asset delivery for vendor namespaced plugins.

Search up to two directories for plugin names as people will often use vendor namespaced plugins and AssetFilter should handle that scenario.

I've also fixed up the Risky test output in PHPUnit as this will incorrectly mask any failures in the future.

Fixes #4616
Good point. I'll remove that and add isset() checks to prevent notices.