What does the
community use for this kind of scan / report storing and
querying?
This isn't ideal -- but I generally use an oscap cron with "brief"
results going to centralized syslog. Query the centralized syslog
for results as needed. I also have the HTML reports archived on
an NFS share, which is what the ISSO/ISSM prefer to review. This
works well for anything automated, but the manual check XCCDF
stuff is a mess to manage.