More recovery rules

Better refine the rules surrounding the recovery SELinux
domain, and get rid of dmesg log spam.

Recovery is still in permissive_or_unconfined(), so no expected
change in behavior.

Change-Id: Ie5a86f8f5d7581547879c476ebcfdb8c0876263c