Switch to api.request which supports 2fa

The plugin is using the legacy `heroku.get` which is not fitted for prompting for a two-factor code when required. This change switches to the newer `api.request` method, which does support 2fa.

*Note*: Moved the `repo_get_url` call in `clone` before any fs side effects, as the 2fa code retries the method and causes double nesting of directories, `app/.git/app/.git`.

Fixes #24.
Good catch.