debian/patches/series: Apply security fixes last (except ABI maintenance)

The security fixes are where we have the greatest churn, so it's
convenient if they can be pushed/popped without having to go through
other patches.

debian/patches/series

@@ -158,16 +158,6 @@ features/all/db-mok-keyring/0003-MODSIGN-checking-the-blacklisted-hash-before-lo
 features/all/db-mok-keyring/0004-MODSIGN-check-the-attributes-of-db-and-mok.patch
 features/all/db-mok-keyring/modsign-make-shash-allocation-failure-fatal.patch
 
-# Security fixes
-debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
-debian/ntfs-mark-it-as-broken.patch
-bugfix/all/netfilter-conntrack-use-consistent-ct-id-hash-calcul.patch
-bugfix/all/ALSA-usb-audio-Fix-an-OOB-bug-in-parse_audio_mixer_unit.patch
-bugfix/all/ALSA-usb-audio-Fix-a-stack-buffer-overflow-bug-in-check_input_term.patch
-bugfix/all/vhost-make-sure-log_num-in_num.patch
-bugfix/x86/x86-ptrace-fix-up-botched-merge-of-spectrev1-fix.patch
-bugfix/all/KVM-coalesced_mmio-add-bounds-checking.patch
-
 # Fix exported symbol versions
 bugfix/all/module-disable-matching-missing-version-crc.patch
 
@@ -259,5 +249,15 @@ features/arm/ARM-dts-add-Raspberry-Pi-Compute-Module-3-and-IO-boa.patch
 features/arm64/arm64-dts-broadcom-Add-reference-to-Compute-Module-I.patch
 features/arm64/arm64-dts-broadcom-Use-the-.dtb-name-in-the-rule-rat.patch
 
+# Security fixes
+debian/i386-686-pae-pci-set-pci-nobios-by-default.patch
+debian/ntfs-mark-it-as-broken.patch
+bugfix/all/netfilter-conntrack-use-consistent-ct-id-hash-calcul.patch
+bugfix/all/ALSA-usb-audio-Fix-an-OOB-bug-in-parse_audio_mixer_unit.patch
+bugfix/all/ALSA-usb-audio-Fix-a-stack-buffer-overflow-bug-in-check_input_term.patch
+bugfix/all/vhost-make-sure-log_num-in_num.patch
+bugfix/x86/x86-ptrace-fix-up-botched-merge-of-spectrev1-fix.patch
+bugfix/all/KVM-coalesced_mmio-add-bounds-checking.patch
+
 # ABI maintenance
 debian/abi/powerpc-avoid-abi-change-for-disabling-tm.patch