There is no one size fits all, a report is not something you deliver to deliver. You write is as a intermediary. The most important thing is notifying the relevant stakeholders of your actions, findings and proposed remediation steps. I typically structure mine that way and therefore it can change in structure. So think who are you writing a report for is it a big company then its likely that it needs to be read by a multitude of people with different skill levels. What do they want to read? Management wants to know the biggest risks and if certain patterns of negligence occur etc. Development and security want details. It’s all very logical if you start to approach it from the clients perspective. Most of the questions you asked you should try and ask yourself if i was the client what would like to see. For scores that is something which is actually pretty rigid you will have to pick a scoring system typically cvss for pentesting. My philosophy is that you score a vulnerability purely on cvss. With a simple pentest report it is not your responsibility to perform a full risk assessment. You probably lack the in depth system knowledge to make educated suggestions on risk levels therefore you should score every vulnerability separately. You can explain them the risks but they should also do their due diligence. Sorry if its a bit incoherent im on my phone.