Move default HBA rules

* Postgres HBA honors the first matching rule; setting defaults first
prevents puppet from overriding these defaults