Fix journalctl cursor use

Using --after-cursor in combination with -t audit does produces the expected
output since the filtering logic is applied before and after that the cursor
is moved to next valid entry. In this case, using --after-cursor will cause
the output to miss the first entry in the log.

Fix the issue by using --cursor instead.

Signed-off-by: Walter Lozano <walter.lozano@collabora.com>