Fix journalctl cursor use

Using --after-cursor in combination with -t audit does produces the expected
output since the filtering logic is applied before and after that the cursor
is moved to next valid entry. In this case, using --after-cursor will cause
the output to miss the first entry in the log.

Fix the issue by using --cursor instead.

Signed-off-by: Walter Lozano <walter.lozano@collabora.com>

run-aa-test

@@ -132,7 +132,7 @@ if [ "${UID}" != "0" ]
 then
 	JOURNALCTL="sudo journalctl"
 fi
-${JOURNALCTL} --after-cursor "${START_CURSOR}" -t audit -o cat > ${AUDIT_FILE}
+${JOURNALCTL} --cursor "${START_CURSOR}" -t audit -o cat > ${AUDIT_FILE}
 
 echo "#=== ${TEST_TITLE} ==="