[Bro] Protocl Analyzer: when to Unref a variable

[Valerio]

By looking at some analyzers (e.g., sip, TCP) I noticed that some here
and there (usually after the content of a variable is assigned to
another structure with Append) a call to Unref() is made.

Are there any general principles or guidelines regarding when to
explicitly Unref a variable when writing a Bro Analyzer with BinPAC?

thanks,
Valerio