feat(auth): add JSpecify Null annotations to Auth

[nnicolee]

Summary

This PR migrates the Google Auth Library for Java (google-auth-library-java) to use JSpecify 1.0.0 nullability annotations (@NullMarked and @Nullable), replacing the previous javax.annotation references.

Key Changes

JSpecify 1.0.0 Annotation Adoption in Auth:

• NullMarked Semantics: Applied @NullMarked at the class and package levels across core auth classes (in credentials, oauth2_http, appengine, and cab-token-generator modules) to define non-null by default semantics.
• Annotation Replacement: Replaced imports of javax.annotation.Nullable with org.jspecify.annotations.Nullable.
• Dependency Management: Updated Maven pom.xml files and Bazel BUILD.bazel configurations to declare and manage the org.jspecify:jspecify dependency.

Verification Results

• https://docs.google.com/document/d/1YSg2toS7wXT6gC8whKAxx71_BFkfPVOX8a3s2OlZ25E/edit?resourcekey=0-g0wyO_jvBgHigUg6Pjo1CA&tab=t.pv38dpfp09db

[lqiu96]

/gemini review

[nnicolee]

/gemini review

[gemini-code-assist]

Code Review

This pull request integrates JSpecify nullness annotations (@NullMarked and @Nullable) across multiple modules in the google-auth-library-java repository to enhance static analysis and null safety. The review feedback correctly identifies a critical issue in TokenVerifier.java where @Nullable is applied to type parameters of Guava's ImmutableMap and ImmutableMap.Builder. Because Guava's immutable collections do not allow null values, these changes could lead to runtime NullPointerExceptions. The reviewer advises reverting these map type parameters to PublicKey and adding explicit null checks before inserting elements into the builder.

[gemini-code-assist]

Since Guava's ImmutableMap does not permit null values, the cached map should not contain @Nullable values. Please keep the type parameter as PublicKey.

Suggested change

	private final LoadingCache<String, Map<String, @Nullable PublicKey>> publicKeyCache;
	private final LoadingCache<String, Map<String, PublicKey>> publicKeyCache;

[gemini-code-assist]

Since Guava's ImmutableMap does not permit null values, the map returned by the loader should not contain @Nullable values. Please keep the type parameter as PublicKey.

Suggested change

	static class PublicKeyLoader extends CacheLoader<String, Map<String, @Nullable PublicKey>> {
	static class PublicKeyLoader extends CacheLoader<String, Map<String, PublicKey>> {

[gemini-code-assist]

Since Guava's ImmutableMap does not permit null values, the map returned by load should not contain @Nullable values. Please keep the type parameter as PublicKey.

Suggested change

	public Map<String, @Nullable PublicKey> load(String certificateUrl) throws Exception {
	public Map<String, PublicKey> load(String certificateUrl) throws Exception {

[gemini-code-assist]

Guava's ImmutableMap and its builder do not permit null keys or values. Declaring the builder as ImmutableMap.Builder<String, @Nullable PublicKey> is problematic because if buildPublicKey(key) returns null and is added to the builder, it will throw a NullPointerException at runtime. If null values are filtered out before being added to the builder, then the map will never contain null values, and the type parameter should be PublicKey instead of @Nullable PublicKey to accurately reflect the map's contents and avoid type-safety issues. Please revert the map and builder type parameters to PublicKey (without @Nullable).

Suggested change

	ImmutableMap.Builder<String, @Nullable PublicKey> keyCacheBuilder = new ImmutableMap.Builder<>();
	ImmutableMap.Builder<String, PublicKey> keyCacheBuilder = new ImmutableMap.Builder<>();

[gemini-code-assist]

Since Guava's ImmutableMap does not permit null values, the built map should not contain @Nullable values. Please keep the type parameter as PublicKey.

Suggested change

	ImmutableMap<String, @Nullable PublicKey> keyCache = keyCacheBuilder.build();
	ImmutableMap<String, PublicKey> keyCache = keyCacheBuilder.build();

[gemini-code-assist]

Since buildPublicKey is now annotated with @Nullable and can return null, please ensure that the caller explicitly checks for null before adding the returned key to keyCacheBuilder. Guava's ImmutableMap.Builder will throw a NullPointerException if a null value is added.