- Remove duplication in functions (add/addCopy were basically the same)
- Fix addRef to actually reference the value (previously it was also copying)
- Use addRef in some places (such as file carving) where it can save on allocations

Verified by running allocations profile with Instruments on macOS and
observing that with the changes addRef creates fewer allocations.

There may be other places where addRef can be used, and there may be
places where a pushRef could make sense. This PR aims to make the
names at least consistent with the behaviors.

zwass added a commit to zwass/osquery that referenced this pull request

zwass mentioned this pull request

zwass added a commit that referenced this pull request

Modified code in #8740 used the JSON function that was refactored in
#8738. This breaks the build.