There are a few cases like src/mongo/db/pipeline/document_source_query_stats.h:requiredPrivileges that return a copy of the PrivilegeVector instead of something more efficient. We should have these return const refs where possible, to avoid copies as much as possible.