fix: GHCR attestation example by listing GHCR first in metadata images

The attestation step targets GHCR, but docker/build-push-action exposes the
digest for the first image produced by docker/metadata-action. The previous
doc snippet listed Docker Hub first, so the attestation attempted to fetch a
Docker Hub digest from GHCR, resulting in 404.

Author: LindonAliu

content/actions/tutorials/publish-packages/publish-docker-images.md

@@ -215,8 +215,8 @@ jobs:
         uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
         with:
           images: |
-            my-docker-hub-namespace/my-docker-hub-repository
             {% data reusables.package_registry.container-registry-hostname %}/{% raw %}${{ github.repository }}{% endraw %}
+            my-docker-hub-namespace/my-docker-hub-repository
 
       - name: Build and push Docker images
         id: push