cli: fix cpu secure option to actually work

The 'secure' option is processed after the model is already set.
CPU security options are resolved while setting CPU model so we need
to know the 'secure' option value before we set the CPU model.

Signed-off-by: Pavel Hrdina <phrdina@redhat.com>

tests/cli-test-xml/compare/virt-install-cpu-disable-sec.xml

@@ -14,8 +14,6 @@
   </features>
   <cpu mode="custom" match="exact">
     <model>qemu64</model>
-    <feature policy="require" name="spec-ctrl"/>
-    <feature policy="require" name="ssbd"/>
   </cpu>
   <clock offset="utc">
     <timer name="rtc" tickpolicy="catchup"/>
@@ -63,8 +61,6 @@
   </features>
   <cpu mode="custom" match="exact">
     <model>qemu64</model>
-    <feature policy="require" name="spec-ctrl"/>
-    <feature policy="require" name="ssbd"/>
   </cpu>
   <clock offset="utc">
     <timer name="rtc" tickpolicy="catchup"/>

virtinst/cli.py

@@ -1951,11 +1951,12 @@ class ParserCPU(VirtCLIParser):
     @classmethod
     def _init_class(cls, **kwargs):
         VirtCLIParser._init_class(**kwargs)
+        # 'secure' needs to be parsed before 'model'
+        cls.add_arg("secure", "secure", is_onoff=True)
         cls.add_arg("model", "model", cb=cls.set_model_cb)
         cls.add_arg("mode", "mode")
         cls.add_arg("match", "match")
         cls.add_arg("vendor", "vendor")
-        cls.add_arg("secure", "secure", is_onoff=True)
         cls.add_arg("cache.mode", "cache.mode")
         cls.add_arg("cache.level", "cache.level")