Don't use DIRECTORY_SEPARATOR to filter upload directory

The value of DIRECTORY_SEPARATOR in IIS is '\', which is the MySQL escape
character. As such, it was not being written properly to the database when
recording _wp_attached_file and wp_attachment_metadata postmeta, resulting
in malformed attachment URLs. By using '/' across platforms, we allow IIS to do
its own internal path translations.

See #363

Props @dcavins