feat(auth): add JSpecify Null annotations to Auth (#13842)

## Summary
This PR migrates the Google Auth Library for Java
(`google-auth-library-java`) to use JSpecify 1.0.0 nullability
annotations (`@NullMarked` and `@Nullable`), replacing the previous
`javax.annotation` references.

## Key Changes

### JSpecify 1.0.0 Annotation Adoption in Auth:
- **NullMarked Semantics**: Applied `@NullMarked` at the class and
package levels across core auth classes (in `credentials`,
`oauth2_http`, `appengine`, and `cab-token-generator` modules) to define
non-null by default semantics.
- **Annotation Replacement**: Replaced imports of
`javax.annotation.Nullable` with `org.jspecify.annotations.Nullable`.
- **Dependency Management**: Updated Maven `pom.xml` files and Bazel
`BUILD.bazel` configurations to declare and manage the
`org.jspecify:jspecify` dependency.

## Verification Results
-
https://docs.google.com/document/d/1YSg2toS7wXT6gC8whKAxx71_BFkfPVOX8a3s2OlZ25E/edit?resourcekey=0-g0wyO_jvBgHigUg6Pjo1CA&tab=t.pv38dpfp09db

Author: nnicolee

google-auth-library-java/appengine/java/com/google/auth/appengine/AppEngineCredentials.java

@@ -48,13 +48,16 @@
 import java.util.Collection;
 import java.util.Date;
 import java.util.Objects;
+import org.jspecify.annotations.NullMarked;
+import org.jspecify.annotations.Nullable;
 
 /**
  * OAuth2 credentials representing the built-in service account for Google App Engine. You should
  * only use this class if you are running on AppEngine and are using urlfetch.
  *
  * <p>Fetches access tokens from the App Identity service.
  */
+@NullMarked
 public class AppEngineCredentials extends GoogleCredentials implements ServiceAccountSigner {
 
   private static final long serialVersionUID = -2627708355455064660L;
@@ -122,7 +125,7 @@ public String toString() {
   }
 
   @Override
-  public boolean equals(Object obj) {
+  public boolean equals(@Nullable Object obj) {
     if (!(obj instanceof AppEngineCredentials)) {
       return false;
     }

google-auth-library-java/appengine/pom.xml

@@ -93,5 +93,9 @@
        <artifactId>error_prone_annotations</artifactId>
        <scope>compile</scope>
     </dependency>
+    <dependency>
+      <groupId>org.jspecify</groupId>
+      <artifactId>jspecify</artifactId>
+    </dependency>
   </dependencies>
 </project>

google-auth-library-java/cab-token-generator/java/com/google/auth/credentialaccessboundary/ClientSideCredentialAccessBoundaryFactory.java

@@ -78,6 +78,8 @@
 import java.util.Date;
 import java.util.List;
 import java.util.concurrent.ExecutionException;
+import org.jspecify.annotations.NullMarked;
+import org.jspecify.annotations.Nullable;
 
 /**
  * A factory for generating downscoped access tokens using a client-side approach.
@@ -136,6 +138,7 @@
  * token, allowing for automatic token refreshes by providing a {@link
  * OAuth2CredentialsWithRefresh.OAuth2RefreshHandler}.
  */
+@NullMarked
 public class ClientSideCredentialAccessBoundaryFactory {
   static final Duration DEFAULT_REFRESH_MARGIN = Duration.ofMinutes(45);
   static final Duration DEFAULT_MINIMUM_TOKEN_LIFETIME = Duration.ofMinutes(30);
@@ -144,9 +147,9 @@ public class ClientSideCredentialAccessBoundaryFactory {
   private final String tokenExchangeEndpoint;
   private final Duration minimumTokenLifetime;
   private final Duration refreshMargin;
-  private RefreshTask refreshTask;
+  private @Nullable RefreshTask refreshTask;
   private final Object refreshLock = new byte[0];
-  private volatile IntermediateCredentials intermediateCredentials = null;
+  private volatile @Nullable IntermediateCredentials intermediateCredentials = null;
   private final Clock clock;
   private final CelCompiler celCompiler;
 

google-auth-library-java/cab-token-generator/pom.xml

@@ -60,6 +60,10 @@
       <groupId>com.google.crypto.tink</groupId>
       <artifactId>tink</artifactId>
     </dependency>
+    <dependency>
+      <groupId>org.jspecify</groupId>
+      <artifactId>jspecify</artifactId>
+    </dependency>
 
     <dependency>
       <groupId>junit</groupId>

google-auth-library-java/credentials/BUILD.bazel

@@ -1,5 +1,8 @@
 java_library(
     name = "credentials",
     srcs = glob(["java/**/*.java"]),
+    deps = [
+        "@org_jspecify_jspecify//jar",
+    ],
     visibility = ["//visibility:public"],
 )

google-auth-library-java/credentials/java/com/google/auth/ApiKeyCredentials.java

@@ -35,6 +35,8 @@
 import java.util.Collections;
 import java.util.List;
 import java.util.Map;
+import org.jspecify.annotations.NullMarked;
+import org.jspecify.annotations.Nullable;
 
 /**
  * Credentials class for calling Google APIs using an API key.
@@ -49,6 +51,7 @@
  * Credentials credentials = ApiKeyCredentials.create("your api key");
  * </code></pre>
  */
+@NullMarked
 public class ApiKeyCredentials extends Credentials {
   static final String API_KEY_HEADER_KEY = "x-goog-api-key";
   private final String apiKey;
@@ -70,7 +73,7 @@ public String getAuthenticationType() {
   }
 
   @Override
-  public Map<String, List<String>> getRequestMetadata(URI uri) throws IOException {
+  public Map<String, List<String>> getRequestMetadata(@Nullable URI uri) throws IOException {
     return Collections.singletonMap(API_KEY_HEADER_KEY, Collections.singletonList(apiKey));
   }
 

google-auth-library-java/credentials/java/com/google/auth/CredentialTypeForMetrics.java

@@ -31,6 +31,8 @@
 
 package com.google.auth;
 
+import org.jspecify.annotations.NullMarked;
+
 /**
  * Defines the different types of credentials that can be used for metrics.
  *
@@ -44,6 +46,7 @@
  *
  * @see #getLabel()
  */
+@NullMarked
 public enum CredentialTypeForMetrics {
   USER_CREDENTIALS("u"),
   SERVICE_ACCOUNT_CREDENTIALS_AT("sa"),

google-auth-library-java/credentials/java/com/google/auth/Credentials.java

@@ -37,8 +37,11 @@
 import java.util.List;
 import java.util.Map;
 import java.util.concurrent.Executor;
+import org.jspecify.annotations.NullMarked;
+import org.jspecify.annotations.Nullable;
 
 /** Represents an abstract authorized identity instance. */
+@NullMarked
 public abstract class Credentials implements Serializable {
 
   private static final long serialVersionUID = 808575179767517313L;
@@ -161,7 +164,8 @@ protected final void blockingGetToCallback(URI uri, RequestMetadataCallback call
    *     implement {@link Retryable} and {@code isRetryable()} will return true if the operation may
    *     be retried.
    */
-  public abstract Map<String, List<String>> getRequestMetadata(URI uri) throws IOException;
+  public abstract Map<String, List<String>> getRequestMetadata(@Nullable URI uri)
+      throws IOException;
 
   /**
    * Whether the credentials have metadata entries that should be added to each request.

google-auth-library-java/credentials/java/com/google/auth/RequestMetadataCallback.java

@@ -33,12 +33,14 @@
 
 import java.util.List;
 import java.util.Map;
+import org.jspecify.annotations.NullMarked;
 
 /**
  * The callback that receives the result of the asynchronous {@link
  * Credentials#getRequestMetadata(java.net.URI, java.util.concurrent.Executor,
  * RequestMetadataCallback)}. Exactly one method should be called.
  */
+@NullMarked
 public interface RequestMetadataCallback {
   /**
    * Called when metadata is successfully produced.

google-auth-library-java/credentials/java/com/google/auth/Retryable.java

@@ -31,7 +31,10 @@
 
 package com.google.auth;
 
+import org.jspecify.annotations.NullMarked;
+
 // an interface to identify retryable errors
+@NullMarked
 public interface Retryable {
   /**
    * A flag indicating whether the error is retryable