The Scottish Police Authority (SPA) has improved how it operates but policing in Scotland is not financially sustainable, says the Auditor General for Scotland.