bitbake.conf: Include cve-check-map earlier, before distro

It makes sense for the distro to be able to override "policy" from cve-check-map
which is intented to provide defaults. Tweak the ordering to allow for this,
ensuring it is included before the distro includes.

Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>