Make recovery domain permissive so we can set SELinux permissive

This change makes the recovery domain permissive so that we can
use the recovery selabel in the init.rc to set SELinux permissive
in recovery.

Change-Id: Ib371ff9f0a0b2c5a0a97183afaf1fe89c5a90dc1