Better webroot structure (web/)

Bedrock currently exposes a lot of files to the webroot that shouldn't be there. The README provides some web server configs to block access to these files, but it's still not a proper solution.

This PR moves what's required into a `web/` directory including the vendor'd WP source, and the app source itself. Now an Apache/Nginx site should be pointed to `/path/to/site/web/` instead of just `/path/to/site/`

The name `web` was chosen since it reflects that its the `webroot`. `public` is a very common name in frameworks like Symfony, Rails, Laravel etc, but it doesn't directly map to our use case since that's always for static file serving like images, scripts, css etc.

See #10 for more discussion.