Asset URLs not registered properly in subdomain sites

[kadamwhite]

Steps to reproduce:

1. For a multisite network e.g. something.altis.cloud, define a subsite at something.altis.cloud/some/path
2. Force 2FA on that environment
3. Observe that no scripts or styles load on the "choose your 2FA provider" form when trying to log in

I expected a functional 2FA form. Instead, we see 404s for all the two-factor plugin scripts and styles, because they get registered as,

https://subdomain.site.altis.cloud/sub/directory/vendor/humanmade/two-factor/assets/js/force-2fa.js

instead of

https://subdomain.site.altis.cloud/vendor/humanmade/two-factor/assets/js/force-2fa.js

The two-factor plugin (both our fork and the upstream copy) use plugins_url( '...blah.js', __FILE__ ) to deduce the URL for the asset. That resolves to full/site/path/vendor... instead of /vendor... when used in an Altis site where the plugin is installed to vendor/humanmade/two-factor.

Acceptance criteria:

• Scripts and styles are registered with valid URIs

[kadamwhite]

Filed upstream in 2FA plugin at WordPress/two-factor#489