fix(auth): add missing @Nullable annotations across credential types and providers

[lqiu96]

This PR is part 2 of 3 in a stacked series of JSpecify nullability fixes for google-auth-library-java:

1. fix(auth): fix JSpecify nullability in UserAuthorizer and TokenStore #14150: fix(auth): fix JSpecify nullability in UserAuthorizer and TokenStore (resolves JSpecify incompatibility #14147)
2. This PR (fix(auth): add missing @Nullable annotations across credential types and providers #14153): fix(auth): add missing @Nullable annotations across credential types and providers
3. fix(auth): annotate builder fields, setters, and getters as @Nullable across credential builders #14154: fix(auth): annotate builder fields, setters, and getters as @Nullable across credential builders

---

Description

Following the migration of google-auth-library-java to @NullMarked, an audit of all credential types, credential providers, and token utilities identified several methods that can accept or return null in standard usage patterns.

This PR adds @Nullable annotations to the following non-builder surfaces:

• IdTokenProvider: targetAudience parameter in idTokenWithAudience(...)Option and Option#getOptionTargetAudience() return type.
• UserAuthorizer: getCredentials return type, getCredentialsFromCallback parameters, getAuthorizationUrl parameters (userId, state).
• UserCredentials: constructor clientId and clientSecret parameters (and corresponding getter returns), which are nullable for 3-legged scenarios and user credential definitions.
• ServiceAccountCredentials / ServiceAccountJwtAccessCredentials: nullable serviceAccountUser constructor parameter and getters, privateKeyId, privateKey, clientEmail, clientId where optional.
• ExternalAccountCredentials & subclasses (AwsCredentials, IdentityPoolCredentials, PluggableAuthCredentials, ExternalAccountAuthorizedUserCredentials): nullable constructor parameters and getters for optional parameters (workforcePoolUserProject, serviceAccountImpersonationUrl, quotaProjectId, subjectToken, etc.).
• DownscopedCredentials & ImpersonatedCredentials: nullable optional fields and constructors.
• GdchCredentials: nullable constructor parameters and getters for optional endpoints/tokens.
• Token refresh utilities: OAuth2CredentialsWithRefresh, RefreshHandler, DefaultTokenRefresher, SecureSessionAgent.

[gemini-code-assist]

Code Review

This pull request systematically adds @Nullable annotations across various credential classes, builders, and utility methods in the google-auth-library-java library to improve nullness analysis and JSpecify compliance. The review feedback points out a few instances in ExternalAccountCredentials, GoogleCredentials, and UserCredentials where the @Nullable annotation was placed before the method modifiers instead of directly on the return type. Correcting these placements will ensure consistency with the rest of the codebase and proper JSpecify compliance.

[gemini-code-assist]

For JSpecify compliance and consistency with other changes in this PR (such as in AwsCredentials.java), the @Nullable annotation should be placed on the return type itself rather than before the method modifiers.

Please update it to:

public @Nullable String getTokenInfoUrl() {

[gemini-code-assist]

For JSpecify compliance and consistency, the @Nullable annotation should be placed on the return type itself rather than before the method modifiers.

Please update it to:

public @Nullable String getProjectId() {

[gemini-code-assist]

For JSpecify compliance and consistency, the @Nullable annotation should be placed on the return type itself rather than before the method modifiers.

Please update it to:

public final @Nullable String getRefreshToken() {