builder/cache/options: fix order of build args when using registry

[admtnnr]

Background

When using the build cache with the registry cache type the order of options given to docker build --cache-to appears to be significant and the ref option MUST come first, directly after the type=registry option.

The error looks like the following with the existing implementation that appends the ref option at the end of the builder/cache/options:

DEBUG [f3e45b60] Command: docker buildx build --push -t $ACCOUNT.dkr.ecr.us-east-2.amazonaws.com/$REPO:$SHA -t $ACCOUNT.dkr.ecr.us-east-2.amazonaws.com/$REPO:latest --cache-to type=registry,mode=max,compression=zstd,oci-mediatypes=true,image-manifest=true
,ref=$ACCOUNT.dkr.ecr.us-east-2.amazonaws.com/$REPO-build-cache --cache-from type=registry,ref=$ACCOUNT.dkr.ecr.us-east-2.amazonaws.com/$REPO-build-cache --label service="$APP" --file Dockerfile .
 DEBUG [f3e45b60] 	ERROR: "docker buildx build" requires exactly 1 argument.
 DEBUG [f3e45b60] 	See 'docker buildx build --help'.
 DEBUG [f3e45b60] 	
 DEBUG [f3e45b60] 	Usage:  docker buildx build [OPTIONS] PATH | URL | -
 DEBUG [f3e45b60] 	
 DEBUG [f3e45b60] 	Start a build
 DEBUG [f3e45b60] 	sh: 2: ,ref=$ACCOUNT.dkr.ecr.us-east-2.amazonaws.com/$REPO-build-cache: not found
  Finished all in 9.3 seconds

I can't just remove the other options because the oci-mediatypes=true,image-manifest=true options are required to use the build cache with ECR.

I targeted the 1-8-stable branch instead of main as this is a blocking bug.