React version: `18.3.0-canary-9377e1010-20230712`

## Steps To Reproduce

1. Add  `<meta name="viewport" content="width=device-width, initial-scale=1" />` inside of `<head>`
2. Call `ReactDOM.preload('/img.png', { as: 'image' })` 

## The current behavior

The `<link>` generated from the preload is before the `<meta>` for the viewport.

## The expected behavior

The `<link>` should come after the `<meta>` for the viewport.

## Related

- https://github.com/vercel/next.js/issues/53574

cc @gnoff 
* escaping html comment string sequences that are valid javascript as well because
 * if there are no sebsequent <script sequences the html parser will never enter
 * script data double escaped state (see: https://www.w3.org/TR/html53/syntax.html#script-data-double-escaped-state)
 *
 * While untrusted script content should be made safe before using this api it will
 * ensure that the script cannot be early terminated or never terminated state
 */
function escapeBootstrapScriptContent(scriptText: string) {
  if (__DEV__) {
    checkHtmlStringCoercion(scriptText);
  }
  return ('' + scriptText).replace(scriptRegex, scriptReplacer);
}
const scriptRegex = /(<\/|<)(s)(cript)/gi;
const scriptReplacer = (
  match: string,
  prefix: string,
  s: string,
  suffix: string,
) => `${prefix}${s === 's' ? '\\u0073' : '\\u0053'}${suffix}`;
export type BootstrapScriptDescriptor = {
  src: string,
  integrity?: string,
  crossOrigin?: string,
};
export type ExternalRuntimeScript = {
  src: string,
  chunks: Array<Chunk | PrecomputedChunk>,
};
export function createResponseState(