Fallback to hard reboot if userspace reboot hasn't started in time

Similarly to other recovery mechanisms, timeout is controlled by a
read-only property that can be configured per-device.

Test: adb root
Test: adb shell setprop init.userspace_reboot.started.timeoutmillis 2
Test: adb reboot userspace
Bug: 152803929
Change-Id: Id70710b46da798945ac5422ef7d69265911ea5ef