arch: arm: userspace: fix the incorrect ssf under bad syscall

The parameter ssf of the handler_bad_syscall got null pointer
due to that the R1 does not push into the stack in a right
order on cortex-M0. Adjust the pushing order of stack to make
the ssf being passed correctly.

Fixes #50146.

Signed-off-by: Enjia Mai <enjia.mai@intel.com>