<p>I'm wondering if there's some kind of criteria that can be used to determine where a script or file should go.</p>

If you don't mind the possibility that anyone might be able to see the contents then put it inside the web path. Otherwise keep it outside.
Inside:
anything publicly available - images, javascript, css, static content. You'll be putting less strain on the server and will automatically be taking advantage of whatever caching and compression services it has.
Outside:
Anything private. Script files, with password and other sensitive details, might be vulnerable if a server failure results in them being served as text instead of being parsed.