sepolicy: fix a few denials

Change-Id: I9e34b2c78416464fa80e2c2000d9f5b5aabec645
rebootcmd: fix for selinux

* moboot-control needs to run in a special domain so that it can
  remount /boot and write its file
* run it from init based on a prop that is set from rebootcmd denoting
  what we should be rebooting to

Change-Id: Id28e6c78dd404f302c89aa40858d4324cf0351dd