[Email security] Reorder dispositions (#29494)

Author: Maddy-Cloudflare

src/content/docs/cloudflare-one/email-security/settings/auto-moves.mdx

@@ -16,7 +16,7 @@ To configure auto-move events:
 3. Select **Settings**.
 4. Select **Moves**.
 5. Under **Auto-moves**, select **Configure**.
-6. For each disposition (malicious, spoof, suspicious, spam, and bulk), choose what happens to matching emails:
+6. For each disposition (malicious, spam, bulk, suspicious, spoof), choose what happens to matching emails:
    - **Soft delete - user recoverable**: Moves the message to the user's **Recoverable Items - Deleted** folder. The user can still find and restore the message. This option is only available for Microsoft 365 customers. Refer to [Microsoft 365 Exchange data deletion](https://learn.microsoft.com/en-us/compliance/assurance/assurance-exchange-online-data-deletion) for more information.
    - **Hard delete - admin recoverable**: Removes the message from the user's inbox entirely. Only an administrator can recover it. 
    - **Move to trash**: Moves the message to the user's trash or deleted items folder. This option is only available for Google Workspace users.

src/content/partials/cloudflare-one/email-security/dispositions-and-attributes.mdx

@@ -1,10 +1,10 @@
 - **Malicious**: Traffic associated with active threat campaigns. Malicious messages invoked multiple phishing verdict triggers and met thresholds for bad behavior.
     - **Recommendation**: Block.
-- **Suspicious**: Traffic associated with phishing campaigns (and is under further analysis by our automated systems).
-    - **Recommendation**: Research these messages internally to evaluate legitimacy.
 - **Spam**: Traffic associated with non-malicious, commercial campaigns.
     - **Recommendation**: Route to existing Spam quarantine folder.
-- **Spoof**: Traffic associated with phishing campaigns that is either non-compliant with your email authentication policies ([SPF](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-spf-record/), [DKIM](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dkim-record/), [DMARC](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dmarc-record/)) or has mismatching `Envelope From` and `Header From` values.
-    - **Recommendation**: Block after investigating (can be triggered by third-party mail services).
 - **Bulk**: Traffic often associated with newsletters or marketing campaigns. Refer to [Graymail](https://en.wikipedia.org/wiki/Graymail_%28email%29) for more details.
-    - **Recommendation**: Monitor or tag.
+    - **Recommendation**: Monitor or tag.
+- **Suspicious**: Traffic associated with phishing campaigns (and is under further analysis by our automated systems).
+    - **Recommendation**: Research these messages internally to evaluate legitimacy.
+- **Spoof**: Traffic associated with phishing campaigns that is either non-compliant with your email authentication policies ([SPF](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-spf-record/), [DKIM](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dkim-record/), [DMARC](https://www.cloudflare.com/en-gb/learning/dns/dns-records/dns-dmarc-record/)) or has mismatching `Envelope From` and `Header From` values.
+    - **Recommendation**: Block after investigating (can be triggered by third-party mail services).