Fix some callers of "create a module script"

This algorithm was not always being called with the correct arguments;
in particular, when creating an inline module script, the cryptographic
nonce, parser state, and credentials mode were not being set correctly.
This fixes that call site and also updates its argument order to be
consistent with other nearby algorithms.

source

@@ -57838,6 +57838,22 @@ o............A....e
    <li><p>Let <var>CORS setting</var> be the current state of the element's <code
    data-x="attr-script-crossorigin">crossorigin</code> content attribute.</p></li>
 
+   <li>
+    <p>Let <var>module script credentials mode</var> be determined by switching on <var>CORS
+    setting</var>:</p>
+
+    <dl class="switch">
+     <dt><span data-x="attr-crossorigin-none">No CORS</span></dt>
+     <dd>"<code data-x="">omit</code>"</dd>
+
+     <dt><span data-x="attr-crossorigin-anonymous">Anonymous</span></dt>
+     <dd>"<code data-x="">same-origin</code>"</dd>
+
+     <dt><span data-x="attr-crossorigin-none">Use Credentials</span></dt>
+     <dd>"<code data-x="">include</code>"</dd>
+    </dl>
+   </li>
+
    <li>
 
     <p>If the <code>script</code> element has a <code data-x="attr-script-nonce">nonce</code>
@@ -57891,27 +57907,9 @@ o............A....e
 
        <dt>"<code data-x="">module</code>"</dt>
        <dd>
-        <ol>
-         <li>
-          <p>Let <var>credentials mode</var> be determined by switching on <var>CORS
-          setting</var>:</p>
-
-          <dl class="switch">
-           <dt><span data-x="attr-crossorigin-none">No CORS</span></dt>
-           <dd>"<code data-x="">omit</code>"</dd>
-
-           <dt><span data-x="attr-crossorigin-anonymous">Anonymous</span></dt>
-           <dd>"<code data-x="">same-origin</code>"</dd>
-
-           <dt><span data-x="attr-crossorigin-none">Use Credentials</span></dt>
-           <dd>"<code data-x="">include</code>"</dd>
-          </dl>
-         </li>
-
-         <li><p><span>Fetch a module script tree</span> given <var>url</var>, <var>settings</var>,
-         "<code data-x="">script</code>", <var>cryptographic nonce</var>, <var>parser state</var>,
-         and <var>credentials mode</var>.</p></li>
-        </ol>
+        <p><span>Fetch a module script tree</span> given <var>url</var>, <var>settings</var>,
+        "<code data-x="">script</code>", <var>cryptographic nonce</var>, <var>parser state</var>,
+        and <var>module script credentials mode</var>.</p>
        </dd>
       </dl>
 
@@ -57971,8 +57969,9 @@ o............A....e
          document</span>'s <span>document base URL</span>.</p></li>
 
          <li><p>Let <var>script</var> be the result of <span>creating a module script</span> using
-         <var>source text</var>, <var>settings</var>, <var>base URL</var>, and <var>CORS
-         setting</var>.</p></li>
+         <var>source text</var>, <var>settings</var>, <var>base URL</var>, <var>cryptographic
+         nonce</var>, <var>parser state</var>, and <var>module script credentials
+         mode</var>.</p></li>
 
          <li><p>If this returns null, set <span data-x="concept-script-script">the script's
          script</span> to null and abort these substeps; <span>the script is ready</span>.</p></li>
@@ -86838,8 +86837,8 @@ interface <dfn>NavigatorOnLine</dfn> {
 
    <li><p>Let <var>module script</var> be the result of <span>creating a module script</span> given
    <var>source text</var>, <var>module map settings object</var>, <var>response</var>'s <span
-   data-x="concept-response-url">url</span>, <var>credentials mode</var>, and <var>cryptographic
-   nonce</var>.</p></li>
+   data-x="concept-response-url">url</span>, <var>cryptographic
+   nonce</var>, <var>parser state</var>, and <var>credentials mode</var>.</p></li>
 
    <li>
     <p>Set the value of the entry in <var>module map</var> whose key is <var>url</var> to
@@ -86942,8 +86941,8 @@ interface <dfn>NavigatorOnLine</dfn> {
   </ol>
 
   <p>To <dfn data-x="creating a module script">create a module script</dfn>, given some script
-  source, an <span>environment settings object</span>, a script base URL, a credentials mode, a
-  cryptographic nonce, and a parser state:</p>
+  source, an <span>environment settings object</span>, a script base URL, a cryptographic nonce, a
+  parser state, and a credentials mode:</p>
 
   <ol>
 
@@ -86975,15 +86974,15 @@ interface <dfn>NavigatorOnLine</dfn> {
    <li><p>Set <var>script</var>'s <span data-x="concept-module-script-base-url">base URL</span> to
    the script base URL provided.</p></li>
 
-   <li><p>Set <var>script</var>'s <span data-x="concept-module-script-credentials-mode">credentials
-   mode</span> to the credentials mode provided.</p></li>
-
    <li><p>Set <var>script</var>'s <span data-x="concept-module-script-nonce">cryptographic
    nonce</span> to the cryptographic nonce provided.</p></li>
 
    <li><p>Set <var>script</var>'s <span data-x="concept-module-script-parser">parser state</span>
    to the parser state.</p></li>
 
+   <li><p>Set <var>script</var>'s <span data-x="concept-module-script-credentials-mode">credentials
+   mode</span> to the credentials mode provided.</p></li>
+
    <li><p>Return <var>script</var>.</p></li>
 
   </ol>