Hi!
The <noscript> tag of the Google Tag Manager does not have to be the first direct child of the <body> tag. It is recommended to place it as early as possible. So, a coded component could be placed in the top if your default view. The <script> tag should be placed in the header, hence it should be uploaded to the script sources setting in Environment Config.
However, the <noscript> tag is used for browsers not supporting javascript. Appfarm does not work on browsers not supporting javascript. So the <noscript> part of the setup is probably something you will not need to consider.