fixup! Correct logic for obtaining the path to full recovery image

* The original change had the right idea BUT it removed
  the extra vendor from the "root path" instead of the
  "target" path.

* This broke non-vendor building devices who did not
  set BOARD_USES_FULL_RECOVERY_IMAGE.

* This wasn't noticed for so long on 21 as, well, almost
  no one on 21 doesn't build vendor image AND doesn't
  set the full recovery image flag.

* This restores the expected behavior where all components
  are installed to (device relative) `/vendor`.

Change-Id: Id706d90f54c4a87676b58fd11d76236bffa183f0