iptables.prerm: change cleanup order

Deal first with update-alternatives, then do the symlink cleanup.

This avoids errors like this:

Removing iptables (1.8.2-2) ...
update-alternatives: warning: forcing reinstallation of alternative
 /usr/sbin/iptables-nft because link group iptables is broken
update-alternatives: warning: forcing reinstallation of alternative
 /usr/sbin/ip6tables-nft because link group ip6tables is broken
Signed-off-by: Arturo Borrero Gonzalez <arturo@debian.org>

debian/iptables.prerm

@@ -2,6 +2,15 @@
 
 set -e
 
+if [ "$1" != "upgrade" ]; then
+    update-alternatives --remove iptables /usr/sbin/iptables-legacy
+    update-alternatives --remove ip6tables /usr/sbin/ip6tables-legacy
+    update-alternatives --remove iptables /usr/sbin/iptables-nft
+    update-alternatives --remove ip6tables /usr/sbin/ip6tables-nft
+    update-alternatives --remove arptables /usr/sbin/arptables-nft
+    update-alternatives --remove ebtables /usr/sbin/ebtables-nft
+fi
+
 # compat symlinks for /sbin -> /usr/sbin move, to be dropped in buster+1
 if [ "$1" = "remove" ] ; then
 	LIST="/sbin/iptables
@@ -18,14 +27,4 @@ if [ "$1" = "remove" ] ; then
 	done
 fi
 
-if [ "$1" != "upgrade" ]; then
-    update-alternatives --remove iptables /usr/sbin/iptables-legacy
-    update-alternatives --remove ip6tables /usr/sbin/ip6tables-legacy
-    update-alternatives --remove iptables /usr/sbin/iptables-nft
-    update-alternatives --remove ip6tables /usr/sbin/ip6tables-nft
-    update-alternatives --remove arptables /usr/sbin/arptables-nft
-    update-alternatives --remove ebtables /usr/sbin/ebtables-nft
-fi
-
 #DEBHELPER#
-