Allow recovery to read files with oemfs label

The recovery and update_binary need to access the /oem partition for
devices like sprout.

Bug: 19764039
Change-Id: I3647c5d72ed708cd797968669fa1116a3ba39542
(cherry picked from commit d245789c)

recovery.te

@@ -77,6 +77,9 @@ recovery_only(`
   allow recovery cache_file:dir create_dir_perms;
   allow recovery cache_file:file create_file_perms;
 
+  # Read files on /oem.
+  r_dir_file(recovery, oemfs);
+
   # Reboot the device
   set_prop(recovery, powerctl_prop)