Introduce RescueParty.

When a device gets stuck in a crash loop, it's pretty much unusable
and impossible for users to recover from.

To help rescue devices from this state, this change introduces a new
feature that watches for runtime restart loops and persistent app
crash loops, and escalates through a series of increasingly
aggressive rescue operations.  Currently these rescue levels walk
through clearing any experiments in SettingsProvider before finally
rebooting and prompting the user to wipe data.

Crash loops are detected based on a number of events in a specific
window of time.  App stats can be stored in memory, but boot stats
need to be stored in system properties to be more robust.

Start up RecoveryService much earlier during the boot so we can
reboot into recovery when needed.

Add properties tha push system_server or SystemUI into a crash loops
for testing purposes.

Test: builds, boots, forced crashing walks through modes
Bug: 24872457, 30951331
Change-Id: I6cdd37682973fe18de0f08521e88f70ee7d7728b