add recovery system interface to API

Adds android.os.RecoverySystem (marked as pending) to replace the
(hidden) com.android.internal.os.RecoverySystem.  RecoverySystem
contains methods for:

  - verifying the signature of an update package
  - rebooting to install a package
  - rebooting to wipe user data

(The reboot functions require "android.permission.REBOOT" and
"android.permission.ACCESS_CACHE_FILESYSTEM".)  Providing these
simplifies implementation of OTA update for device builders.

Change-Id: I63ce743b156e7a1a0327fd395b0e4a82c0eda79a