playbooks/mirrors: add firewall role and move wireguard up

The sshd role needs to open a firewall hole and will fail if firewalld
isn't present. Also place the wireguard role right after firewall role
because it is needed by promtail further down.

playbooks/mirrors.yml

@@ -3,6 +3,8 @@
   remote_user: root
   roles:
     - { role: common }
+    - { role: firewalld }
+    - { role: wireguard }
     - { role: sshd }
     - { role: root_ssh }
     - { role: certbot }
@@ -13,5 +15,4 @@
     - { role: prometheus_exporters }
     - { role: promtail }
     - { role: fail2ban }
-    - { role: wireguard }
     - { role: geo_dns, when: "'geo_mirrors' in group_names" }