Allow recovery to create device nodes and modify rootfs

tilapia's OTA code for updating the radio image needs to
create files on rootfs and create a character device in /dev.
Add an exception for recovery the the various neverallow rules
blocking this behavior.

Bug: 18281224
Change-Id: I5c57afe0a10b4598fea17f9c5c833bd39551907e
Merge tag 'android-5.0.0_r6' of https://android.googlesource.com/platform/external/sepolicy into HEAD

Android 5.0.0 release 6