change /cache/recovery group to cache

To unbundle system update, we need users other than system to be able
to write the /cache/recovery directory.