Fix duplicate events during audit log rotation
Fix duplicate events during audit log rotation

Found a bug that occurs when the audit log is rotated. Basically, until the first 10000 lines (or first 1MB, whichever happens first) are written to the new log, we would fail to update the marker. This is because before that first 10000 lines, AdditionalDataPending is always false, which would send us down this path:

```
// If the marker is already at 0 we don't have anything to do
if sPos.marker == "0" {
    c.waitFor(time.Second * 5)
    continue
}
```

This would bypass the call to `getNextMarker` and we would consume the same lines over and over until 10000 lines were reached, making AdditionalDataPending true. On our relatively busy production mysql, this could take as long as 35 minutes.

```
time="2018-04-25T16:09:57Z" level=info msg="newest file is a rotated file, we appear to be mid-rotation" expectedFile=audit/server_audit.log newestFile=audit/server_audit.log.1
time="2018-04-25T16:10:02Z" level=debug msg="last marker offset exceeds newest file size, resetting marker to 0" currentOffset=99996906 newFileSize=40522
time="2018-04-25T16:45:04Z" level=debug msg="Got new marker" file=audit/server_audit.log newMarker="17:893320" prevMarker=0
```

honeycombio/rdslogs,honeycombio/rdslogs