Better webroot structure (web/)

Bedrock currently exposes a lot of files to the webroot that shouldn't be there. The README provides some web server configs to block access to these files, but it's still not a proper solution.

This PR moves what's required into a `web/` directory including the vendor'd WP source, and the app source itself. Now an Apache/Nginx site should be pointed to `/path/to/site/web/` instead of just `/path/to/site/`