Allow patching WORKSPACE and BUILD files in http_archive.

By swapping the "workspace_and_buildfile" and "patch" operations in http_archive, we allow users to patch the WORKSPACE and BUILD files using "patch_cmds".

This should be a safe change, because 1) before this change, a patch could not have affected these files anyway, so there should be no patches out there that try to patch these files and 2) for patches that do not affect WORKSPACE or BUILD.bazel files, the order of these operations does not matter.

RELNOTES: WORKSPACE and BUILD.bazel files of http_archive repositories can now be patched using the "patch_cmds" and "patches" attributes.
PiperOrigin-RevId: 291168913
diff --git a/tools/build_defs/repo/http.bzl b/tools/build_defs/repo/http.bzl
index 965be0e..a77f4ed 100644
--- a/tools/build_defs/repo/http.bzl
+++ b/tools/build_defs/repo/http.bzl
@@ -80,8 +80,8 @@
         canonical_id = ctx.attr.canonical_id,
         auth = auth,
     )
-    patch(ctx)
     workspace_and_buildfile(ctx)
+    patch(ctx)
 
     return update_attrs(ctx.attr, _http_archive_attrs.keys(), {"sha256": download_info.sha256})