In commit 2e59623a a fix to the cursor use was introduced. However, the fix
tries to overcome the issue in a wrong way.

The problem is caused by the fact that the cursor is saved before running the
test and then it is used to check newer entries of a specific type (audit).
Since when journalctl is used with -t the cursor is first moved to the first
entry of the specific type the --after-cursor was changed for --cursor to
make the test pass.

However, a better approach would be to save the cursor also taking into
account the type of entry we are interested on, so later when we use it we
can safetly check entries with --after-crusor.

The only tricky case would be if there are no previous entries of the
specific case, which will lead to an empty cursor. So also handle that case.

Signed-off-by: Walter Lozano <walter.lozano@collabora.com>