Cost of policing annual event is almost £12m, and rising safety concerns mean it should be overhauled, report warns