microcode updates: prepend first in initrd

Prevents crashing the kernel on boot if other blobs are prepended
before the microkernel update image.

Fixes #22674.

nixos/modules/hardware/cpu/amd-microcode.nix

···
   ###### implementation
 
   config = mkIf config.hardware.cpu.amd.updateMicrocode {
-    boot.initrd.prepend = [ "${pkgs.microcodeAmd}/amd-ucode.img" ];
+    # Microcode updates must be the first item prepended in the initrd
+    boot.initrd.prepend = mkOrder 1 [ "${pkgs.microcodeAmd}/amd-ucode.img" ];
   };
 
 }

nixos/modules/hardware/cpu/intel-microcode.nix

···
   ###### implementation
 
   config = mkIf config.hardware.cpu.intel.updateMicrocode {
-    boot.initrd.prepend = [ "${pkgs.microcodeIntel}/intel-ucode.img" ];
+    # Microcode updates must be the first item prepended in the initrd
+    boot.initrd.prepend = mkOrder 1 [ "${pkgs.microcodeIntel}/intel-ucode.img" ];
   };
 
 }