confirm before wiping user data in recovery

When using the hidden menu to wipe data in recovery, confirm before
starting the wipe.  (This does not affect booting with the --wipe_data
flag, or using Alt+W on dream with the menu hidden -- those still wipe
data immediately.)