Move TLS below Prometheus in Praefect config

When both TLS and Prometheus are enabled in Praefect, the
'prometheus_listen_addr' setting is placed in the '[tls]' block.
This stops prometheus from being enabled.

This change move prometheus above the so this cannot occur.

changelogs/unreleased/wc-praefect-tls-move.yml

+---
+title: Move TLS below Prometheus in Praefect config
+merge_request: 4575
+author:
+type: fixed

files/gitlab-cookbooks/praefect/templates/default/praefect-config.toml.erb

@@ -9,14 +9,6 @@
 listen_addr = '<%= @listen_addr %>'
 <% end %>
-<% if @tls_listen_addr %>
-# Optional: listen on a secure TCP socket
-tls_listen_addr = '<%= @tls_listen_addr %>'
-[tls]
-certificate_path = '<%= @certificate_path %>'
-key_path = '<%= @key_path %>'
-<% end %>
-
 <% if @socket_path %>
 # # Praefect can listen on a socket when placed on the same machine as all clients
 socket_path = '<%= @socket_path %>'
@@ -27,6 +19,14 @@ socket_path = '<%= @socket_path %>'
 prometheus_listen_addr = '<%= @prometheus_listen_addr %>'
 <% end %>
+<% if @tls_listen_addr %>
+# Optional: listen on a secure TCP socket
+tls_listen_addr = '<%= @tls_listen_addr %>'
+[tls]
+certificate_path = '<%= @certificate_path %>'
+key_path = '<%= @key_path %>'
+<% end %>
+
 [reconciliation]
 <%= "scheduling_interval = '#{@reconciliation_scheduling_interval}'" if @reconciliation_scheduling_interval %>
 <%= "histogram_buckets = #{@reconciliation_histogram_buckets}" if @reconciliation_histogram_buckets %>