Warn the user when cancelling in-progress updates.

Previously, update_engine in recovery would fail in certain scenarios.
If the update state was UNVERIFIED on the target slot, or a merge was
in-progress, then CancelUpdate/BeginUpdate would fail. We are now
allowing these states to cancel, so that recovery can always apply a new
update via adb sideload.

However, this will also destroy any existing OTA state, whether or not
the sideload actually makes it as far as applying any bits. A user can
go from "working OS" to "not working OS" without completing a sideload.

To warn about this, add a new dialog to recovery.

Bug: 352538505
Test: apply OTA, boot to recovery during merge
Change-Id: I294ab9b29cedaacfc8af57e779fc3e5032c050b5