Update security.yml

Ordering access control to prevent a bug