mm: reorder can_do_mlock to fix audit denial