boot into recovery via the pre-recovery service

Change PowerManagerService to start the pre-recovery service rather
than rebooting directly, when requested to reboot into recovery.  Add
a new RECOVERY permission which a caller needs (in addition to REBOOT)
in order to go to recovery.

Bug: 12188746
Change-Id: I39121b701c4724558fe751adfbad79f8567faa43