hostapd: get reference to object before removal

hostapd: get reference to object before removal

`ucv_array_set` releases the array's reference to the object being cleared.
If this is the last reference to the object, it will be freed, making our
pointer `val` invalid.

To avoid this, we need to obtain our own reference to the object so we
can safely return `val`.

Signed-off-by: Matthew Cather <[email protected]>
(cherry picked from commit 6a10da2934441a59283394a84917edf4983e3043)