<!--- Verify first that your issue is not already reported on GitHub -->
<!--- Also test if the latest release and devel branch are affected too -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY
When using **comment** parameter with iptables module, it is not positioned as the right-most object in the actual iptables table.
The outcome looks very bad at the moment.

##### ISSUE TYPE
- Cosmetic Bug Report

##### COMPONENT NAME
<!--- Write the short name of the module, plugin, task or feature below, use your best guess if unsure -->
**iptables** module, **comment** parameter

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes -->
```paste below
ansible 2.9.9
  config file = /home/me/project/ansible.cfg
  configured module search path = ['/home/me/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /home/me/vConstruction/lib/python3.6/site-packages/ansible
  executable location = /home/me/vConstruction/bin/ansible
  python version = 3.6.9 (default, Jul 17 2020, 12:50:27) [GCC 8.4.0]
```

##### CONFIGURATION
<!--- Paste verbatim output from "ansible-config dump --only-changed" between quotes -->
```paste below
DEFAULT_CALLBACK_WHITELIST(/home/me/project/ansible.cfg) = ['profile_tasks']
DEFAULT_HOST_LIST(/home/me/project/ansible.cfg) = ['/home/me/project/inventory']
DEPRECATION_WARNINGS(/home/me/project/ansible.cfg) = False
HOST_KEY_CHECKING(/home/me/project/ansible.cfg) = False
```

##### OS / ENVIRONMENT
<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
Host where I use Ansible: Ubuntu 18.04 via WSL 2.
Target VM where the iptables rules are being created: Ubuntu 18.04.

##### STEPS TO REPRODUCE
<!--- Describe exactly how to reproduce the problem, using a minimal test-case -->
It can be reproduced by using the following task and running `iptables -L` on the target machine.
I added the DNS task as well, because this one looks correct, but I'm sure that's just because I don't have **ctstate** specified.

<!--- Paste example playbooks or commands between quotes below -->
```yaml
- name: Create HTTPS rule
  iptables:
    chain: INPUT
    in_interface: eth0
    protocol: tcp
    destination_port: https
    ctstate: NEW
    jump: ACCEPT
    comment: Accept new inbound HTTPS connections to eth0 interface

- name: Create DNS rule
  iptables:
    chain: INPUT
    protocol: udp
    destination_port: domain
    jump: ACCEPT
    comment: Accept inbound DNS connections
```

<!--- HINT: You can paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- Describe what you expected to happen when running the steps above -->
```bash
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:ssh  ctstate NEW /* Accept new inbound HTTPS connections to eth0 interface */
```
##### ACTUAL RESULTS
<!--- Describe what actually happened. If possible run with extra verbosity (-vvvv) -->

<!--- Paste verbatim command output between quotes -->
```bash
ACCEPT     tcp  --  anywhere             anywhere             tcp dpt:https /* Accept new inbound HTTPS connections to eth0 interface */ ctstate NEW
ACCEPT     udp  --  anywhere             anywhere             udp dpt:domain /* Accept inbound DNS connections */
```

short_description: Modify iptables rules
version_added: "2.0"
author:
- Linus Unnebäck (@LinusU) <linus@folkdatorn.se>
- Sébastien DA ROCHA (@sebastiendarocha)
description:
  - C(iptables) is used to set up, maintain, and inspect the tables of IP packet
    filter rules in the Linux kernel.
  - This module does not handle the saving and/or loading of rules, but rather
    only manipulates the current rules that are present in memory. This is the
    same as the behaviour of the C(iptables) and C(ip6tables) command which
    this module uses internally.
notes:
  - This module just deals with individual rules.If you need advanced
    chaining of rules the recommended way is to template the iptables restore
    file.
options:
  table:
    description:
      - This option specifies the packet matching table which the command should operate on.
      - If the kernel is configured with automatic module loading, an attempt will be made
         to load the appropriate module for that table if it is not already there.
    type: str
    choices: [ filter, nat, mangle, raw, security ]
    default: filter
  state:
    description:
      - Whether the rule should be absent or present.
    type: str
    choices: [ absent, present ]