sepolicy: add initial policy for cust

I was planning on doing this properly (maybe) at some point, but
this is necessary to fix formatting cust in recovery as make_ext4fs
doesn't have a security context to look up.