Make recovery domain permissive so we can set SELinux permissive

This change makes the recovery domain permissive so that we can
use the recovery selabel in the init.rc to set SELinux permissive
in recovery.

Change-Id: Ib371ff9f0a0b2c5a0a97183afaf1fe89c5a90dc1
Merge branch 'android-5.0' of https://github.com/omnirom/android_external_sepolicy into android-5.0