[FEATURE] When using external_auth, parameters starting with '^' should be placed first

[daks]

Your setup

Formula commit hash / release tag

current master

Pillar / config used

If you want to use an external authentication, for example the file one https://docs.saltstack.com/en/latest/ref/auth/all/salt.auth.file.html, parameters are defined prefixing them with '^' and ACL are not.

salt:
  master:
    external_auth:
      file:
        ^filename: '/etc/salt/external_users.txt'
        ^hashtype: 'sha256'
        ^filetype: 'text'
        foo:
          '.*'
         bar:
          '.*.'
         baz:
          '.*.'

---

Bug details

Describe the bug

The code generating /etc/salt/master.d/f_defaults.conf takes all key/values and makes (nearly) no difference between parameters with '^' and ACL.

If you have a long list of ACL, parameters are lost in the middle of the ACL and not easily viewed in the config file.

The resulting config file can looks like:

external_auth:
  file:
    foo:
      - '.*'
    ^filename: '/etc/salt/external_users.txt'
    bar:
      - '.*'
    ^hashtype: 'sha256'
    baz:
      - '.*'
    ^filetype: 'text'
    foobar:
      - '.*'

Steps to reproduce the bug

Expected behaviour

It may be interesting to differenciate how we manipulate auth parameters and ACL so we can write first the parameters and then the ACL.

Attempts to fix the bug

Additional context

[myii]

@daks Using f_defaults.conf directly from the pillar is something we're moving away from; the current template is still based on 2016.11 (see the long discussion in #398). TOFS has been configured for this formula, so this situation could be avoided using that.