sepolicy: recovery: fix neverallows

 * allow recovery block_device:blk_file { rename };
   We don't really need rename so expand create_file_perms into
   just what we need

Change-Id: I5552df47a8858eda875b93f910dbeb519f2b1c2d