Use oscap_source to retrieve SCAP files

This adds support for bz2 among other things. And it unifies the way we
read SCAP files to be consistent with how xccdf_session does it.