<!--- Verify first that your issue is not already reported on GitHub -->
<!--- Also test if the latest release and devel branch are affected too -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY
When using **comment** parameter with iptables module, it is not positioned as the right-most object in the actual iptables table.
The outcome looks very bad at the moment.

##### ISSUE TYPE
- Cosmetic Bug Report

##### COMPONENT NAME
<!--- Write the short name of the module, plugin, task or feature below, use your best guess if unsure -->
**iptables** module, **comment** parameter

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes -->
```paste below
ansible 2.9.9
  config file = /home/me/project/ansible.cfg
  configured module search path = ['/home/me/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/me/vConstruction/lib/python3.6/site-packages/ansible
  executable location = /home/me/vConstruction/bin/ansible
  python version = 3.6.9 (default, Jul 17 2020, 12:50:27) [GCC 8.4.0]
```

##### CONFIGURATION
<!--- Paste verbatim output from "ansible-config dump --only-changed" between quotes -->
```paste below
DEFAULT_CALLBACK_WHITELIST(/home/me/project/ansible.cfg) = ['profile_tasks']
DEFAULT_HOST_LIST(/home/me/project/ansible.cfg) = ['/home/me/project/inventory']
DEPRECATION_WARNINGS(/home/me/project/ansible.cfg) = False
HOST_KEY_CHECKING(/home/me/project/ansible.cfg) = False
```

##### OS / ENVIRONMENT
<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
Host where I use Ansible: Ubuntu 18.04 via WSL 2.
Target VM where the iptables rules are being created: Ubuntu 18.04.

##### STEPS TO REPRODUCE
<!--- Describe exactly how to reproduce the problem, using a minimal test-case -->
It can be reproduced by using the following task and running `iptables -L` on the target machine.
I added the DNS task as well, because this one looks correct, but I'm sure that's just because I don't have **ctstate** specified.

<!--- Paste example playbooks or commands between quotes below -->
```yaml
- name: Create HTTPS rule
  iptables:
    chain: INPUT
    in_interface: eth0
    protocol: tcp
    destination_port: https
    ctstate: NEW
    jump: ACCEPT
    comment: Accept new inbound HTTPS connections to eth0 interface

- name: Create DNS rule
  iptables:
    chain: INPUT
    protocol: udp
    destination_port: domain
    jump: ACCEPT
    comment: Accept inbound DNS connections
```

<!--- HINT: You can paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- Describe what you expected to happen when running the steps above -->
```bash
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh  ctstate NEW /* Accept new inbound HTTPS connections to eth0 interface */
```
##### ACTUAL RESULTS
<!--- Describe what actually happened. If possible run with extra verbosity (-vvvv) -->

<!--- Paste verbatim command output between quotes -->
```bash
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https /* Accept new inbound HTTPS connections to eth0 interface */ ctstate NEW
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain /* Accept inbound DNS connections */
```

- Since there is no way to tell the source or destination ports of such
        a packet (or ICMP type), such a packet will not match any rules which specify them.
      - When the "!" argument precedes fragment argument, the rule will only match head fragments,
        or unfragmented packets.
    type: str
  set_counters:
    description:
      - This enables the administrator to initialize the packet and byte
        counters of a rule (during C(INSERT), C(APPEND), C(REPLACE) operations).
    type: str
  source_port:
    description:
      - Source port or port range specification.
      - This can either be a service name or a port number.
      - An inclusive range can also be specified, using the format C(first:last).
      - If the first port is omitted, C(0) is assumed; if the last is omitted, C(65535) is assumed.
      - If the first port is greater than the second one they will be swapped.
    type: str
  destination_port:
    description:
      - "Destination port or port range specification. This can either be
        a service name or a port number. An inclusive range can also be
        specified, using the format first:last. If the first port is omitted,
        '0' is assumed; if the last is omitted, '65535' is assumed. If the
        first port is greater than the second one they will be swapped.
        This is only valid if the rule also specifies one of the following
        protocols: tcp, udp, dccp or sctp."
    type: str
  to_ports:
    description: