init: powerctl: Reject "keys*" reboot reason unless in recovery

Reject all reboot reason starting with "keys" unless in
recovery mode.  This avoids mission mode, non-root (e.g. shell)
users for triggering privileged reboot modes.

Change-Id: I3727d0a92627a6cdf5f762ac61625c30bfa88946