Prevent mounting of checked-in vendored files

Mount bundle cache specifically on `vendor/cache` instead of all of
`vendor`, which prevents access to vendored javascript code for example.

.drone.yml

@@ -12,7 +12,7 @@ steps:
     settings:
       restore: true
       mount:
-      - ./vendor
+      - ./vendor/cache
     when:
       branch:
         - master
@@ -37,7 +37,7 @@ steps:
     settings:
       rebuild: true
       mount:
-      - ./vendor
+      - ./vendor/cache
     when:
       branch:
         - master