McCree: What's your Halloween costume gonna be this year, Pharah?
"I'm your Huckleberry" is a reference to Doc Holliday in the movie Tombstone. It means "I'm your man" or "I'm the man you're looking for." It's said in response to a threat or a challenge.
"Reach for the sky" is a Toy Story reference as the protagonist "Woody" says it when the string in his back is pulled, however the saying goes back to at least 1913, and is a familiar Western trope that saw heavy use throughout the mid-1900s. 
"I'm the quick, you're the dead" is a likely reference to the saying "There are two kinds of gunfighters; the quick and the dead" or one of several movie titles taken from the saying, though the origins of the phrase go much farther back and use the archaic meaning of "quick" i.e. "Alive".
In his interaction with Sombra, McCree tells her that his name is not Joel. Before his reveal, McCree came to be known as Joel to the community due to a conversation with a developer in 2014 in which he is referred to with that name. At PAX East 2015, Jeff Kaplan lampshaded this when introducing McCree, stating that he "hates to be called Joel."
The author of an in-universe news article discussing a noodle shop robbery that was (presumably) stopped by McCree is named Joel Morricone. The author describes himself as a "guest blogger, coffee drinker, white hat wearer, [and] pundit for hire," and defends McCree's vigilante actions. Though the name may be a reference to the aforementioned, some fans have made comedic theories saying that McCree himself is writing the articles under a pseudonym.
"I'm not good. Not bad. But I sure as hell ain't ugly" is a reference to Clint Eastwood's movie The Good, the Bad and the Ugly.
"I tried being reasonable, didn't take to it" is a reference to a quote said by Clint Eastwood: "I tried being reasonable, I didn't like it."
"Jackpot!" is a reference to a recurring phrase by Dante from "Devil May Cry" series.
"Where'd you learn to shoot like that?" and D.Va's reply are references to the movie Back to the Future 3, in which a gun salesman asks the question and Marty replies "7-11," implying that he learned to shoot real handguns by playing an unspecified arcade game at 7-11 convenience stores.
The voice lines tied to McCree's Mystery Man and Vigilante skins reference The Shadow, a popular American serial drama about a masked vigilante.
The Summer Games voice line "Boom goes the dynamite" is a reference to an old viral video of a college sports cast where the presenter says "boom goes the dynamites" in his play-by-play commentary of a basketball game.
The respawn quote ''Lets start over at the beginning'' may be a reference to the western culture inspired first-person shooter Call of Juarez: Gunslinger where protagonist Silas Greaves is recalling and narrating all of the events of the game, and in the event of a player death would excuse himself and say ''Lets start over at the beginning'' or many other quotes to the same effect before respawning and continuing the story from the last checkpoint.
The English dub of the anime JoJo's Bizarre Adventure: Stardust Crusaders and Diamond is Unbreakable had Mercer lend his voice to the character Jotaro Kujo. In Stardust Crusaders' final episode as Jotaro prepares to defeat his nemesis DIO, he utters "If this were the wild west, a hero would say 'It's high noon'". Fans have also noted striking similarity with Mercer's voicing role between McCree and Jotaro, leading to comparisons throughout the anime series' run in Adult Swim.
↑“Reach for the sky and keep your eyes on God,” was the command of the robbers as they shoved a revolver under the chin of each of their victims. - Newspaperarchive.com. Ogden City, Utah Evening Standard, 10 Jan 1913, p. 10: