fix(auth): annotate builder fields, setters, and getters as @Nullable across credential builders

[lqiu96]

This PR is part 3 of 3 in a stacked series of JSpecify nullability fixes for google-auth-library-java:

1. fix(auth): fix JSpecify nullability in UserAuthorizer and TokenStore #14150: fix(auth): fix JSpecify nullability in UserAuthorizer and TokenStore (resolves JSpecify incompatibility #14147)
2. fix(auth): add missing @Nullable annotations across credential types and providers #14153: fix(auth): add missing @Nullable annotations across credential types and providers
3. This PR (fix(auth): annotate builder fields, setters, and getters as @Nullable across credential builders #14154): fix(auth): annotate builder fields, setters, and getters as @Nullable across credential builders

---

Description

In @NullMarked credential classes and their corresponding Builder nested classes, fields that default to null before setter invocation, or represent optional configuration (such as optional tokens, transport factories, quotas, boundary rules, audiences, scopes, or endpoints), were unannotated, causing IDEs and static analysis tools to flag null assignments or null checks as warnings/errors.

This PR aligns @Nullable annotations across builder fields, builder setters (parameters and returns), and corresponding credential getter return types across 21 credential and authorizer builder classes.

[gemini-code-assist]

Code Review

This pull request introduces @Nullable annotations across various credential and builder classes in the Google Auth Library for Java to improve null-safety. Feedback suggests that while builder fields can be annotated as @Nullable, the corresponding fields in the instantiated credential classes (such as ExternalAccountAuthorizedUserCredentials) should remain non-nullable if they are required and validated during construction, preventing unnecessary null checks in internal logic.

[gemini-code-assist]

In ExternalAccountAuthorizedUserCredentials, fields like audience, tokenUrl, and refreshToken are required for the credential to function (e.g., to perform token refresh). While these fields are appropriately marked as @Nullable in the Builder class (since they start as null before being set), they should remain non-nullable (unannotated under @NullMarked) in the ExternalAccountAuthorizedUserCredentials class itself. Annotating them as @Nullable in the main class weakens null safety, as it forces all internal usages to handle potential null values even though they are guaranteed to be non-null after successful construction/validation.

Suggested change

	private final @Nullable String audience;
	private final @Nullable String tokenUrl;
	private final @Nullable String tokenInfoUrl;
	private final @Nullable String revokeUrl;
	private final @Nullable String clientId;
	private final @Nullable String clientSecret;
	private String refreshToken;
	private @Nullable String refreshToken;
	private final String audience;
	private final String tokenUrl;
	private final @Nullable String tokenInfoUrl;
	private final @Nullable String revokeUrl;
	private final @Nullable String clientId;
	private final @Nullable String clientSecret;
	private String refreshToken;