add in a custom recovery domain

Recent changes to the mainline sepolicy means that the recovery domain
within system has no rights. Before this, only recovery could edit the
system.

Add in a recovery domain that will only come into effect if the system
is booted, and not the recovery. This will allow apps on custom roms
to still edit the system.