Private Files: Prevent cross-site lookup

In a multisite install, we support running mixed private and public sites. To harden our ACL endpoint and prevent accidentally leaking private files via public sites, we now restrict access to files on the same subsite.

https://github.com/Automattic/vip-go-mu-plugins/pull/1975