Uplift dependencing and remove jsr305 dependency

[dnguyenchevy]

There are some legality issues with consuming jsr305 as it's in conflict with Oracle java binary license.

F. JAVA TECHNOLOGY RESTRICTIONS. You may not create, modify, or change the behavior of, or authorize your licensees to create, modify, or change the behavior of, classes, interfaces, or subpackages that are in any way identified as "java", "javax", "sun", “oracle” or similar convention as specified by Oracle in any naming convention designation.

It looks like a majority of our dependencies are moving away from jsr305, which

We'll have to wait for gauva to release new package that does not consume jsr305, google/guava#2960; as well as Spotbug, spotbugs/spotbugs#180

This is more or less to start a discussion on migrating away from jsr305 and prepping for this migration.

[johnlcox]

We're already using spotbugs, so if they have equivalent annotations that is probably the easiest option for us.

Do IntelliJ and Eclipse recognize the spotbugs annotations?