fix(auth): refine JSpecify nullability annotations for core ADC credentials

Refine JSpecify nullability annotations across core ADC credential types:
- Annotate optional fields, getters, and builder setters/fields with @nullable across AccessToken, ComputeEngineCredentials, AppEngineCredentials, DefaultCredentialsProvider, ImpersonatedCredentials, GdchCredentials, CloudShellCredentials, DownscopedCredentials, IdTokenCredentials, and IdTokenProvider.
- Annotate EnvironmentProvider and SystemEnvironmentProvider getEnv methods with @nullable.
- Remove redundant final modifiers on private methods in DefaultCredentialsProvider.
- Ensure correct JSpecify type-use annotation placements on fields, return types, and parameters.
- Migrate Preconditions imports to com.google.common.base.Preconditions.
- Ensure builder copy constructors properly preserve all fields and chain super(credentials).

Author: lqiu96

google-auth-library-java/appengine/java/com/google/auth/appengine/AppEngineCredentials.java

@@ -68,7 +68,8 @@ public class AppEngineCredentials extends GoogleCredentials implements ServiceAc
 
   private transient AppIdentityService appIdentityService;
 
-  private AppEngineCredentials(Collection<String> scopes, AppIdentityService appIdentityService) {
+  private AppEngineCredentials(
+      @Nullable Collection<String> scopes, @Nullable AppIdentityService appIdentityService) {
     this.scopes = scopes == null ? ImmutableSet.<String>of() : ImmutableList.copyOf(scopes);
     this.appIdentityService =
         appIdentityService != null
@@ -96,7 +97,7 @@ public boolean createScopedRequired() {
   }
 
   @Override
-  public GoogleCredentials createScoped(Collection<String> scopes) {
+  public GoogleCredentials createScoped(@Nullable Collection<String> scopes) {
     return new AppEngineCredentials(scopes, appIdentityService);
   }
 
@@ -175,36 +176,44 @@ public Builder toBuilder() {
 
   public static class Builder extends GoogleCredentials.Builder {
 
-    private Collection<String> scopes;
-    private AppIdentityService appIdentityService;
+    private @Nullable Collection<String> scopes;
+    private @Nullable AppIdentityService appIdentityService;
 
     protected Builder() {}
 
     protected Builder(AppEngineCredentials credentials) {
+      super(credentials);
       this.scopes = credentials.scopes;
       this.appIdentityService = credentials.appIdentityService;
     }
 
     @CanIgnoreReturnValue
-    public Builder setScopes(Collection<String> scopes) {
+    public Builder setScopes(@Nullable Collection<String> scopes) {
       this.scopes = scopes;
       return this;
     }
 
     @CanIgnoreReturnValue
-    public Builder setAppIdentityService(AppIdentityService appIdentityService) {
+    public Builder setAppIdentityService(@Nullable AppIdentityService appIdentityService) {
       this.appIdentityService = appIdentityService;
       return this;
     }
 
-    public Collection<String> getScopes() {
+    public @Nullable Collection<String> getScopes() {
       return scopes;
     }
 
-    public AppIdentityService getAppIdentityService() {
+    public @Nullable AppIdentityService getAppIdentityService() {
       return appIdentityService;
     }
 
+    @Override
+    @CanIgnoreReturnValue
+    public Builder setQuotaProjectId(@Nullable String quotaProjectId) {
+      super.setQuotaProjectId(quotaProjectId);
+      return this;
+    }
+
     @Override
     public AppEngineCredentials build() {
       return new AppEngineCredentials(scopes, appIdentityService);

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AccessToken.java

@@ -56,7 +56,7 @@ public class AccessToken implements Serializable {
    * @param tokenValue String representation of the access token.
    * @param expirationTime Time when access token will expire.
    */
-  public AccessToken(String tokenValue, Date expirationTime) {
+  public AccessToken(String tokenValue, @Nullable Date expirationTime) {
     this.tokenValue = tokenValue;
     this.expirationTimeMillis = (expirationTime == null) ? null : expirationTime.getTime();
     this.scopes = new ArrayList<>();
@@ -108,7 +108,7 @@ public String getTokenValue() {
     return new Date(expirationTimeMillis);
   }
 
-  Long getExpirationTimeMillis() {
+  @Nullable Long getExpirationTimeMillis() {
     return expirationTimeMillis;
   }
 
@@ -145,8 +145,8 @@ public boolean equals(@Nullable Object obj) {
   }
 
   public static class Builder {
-    private String tokenValue;
-    private Date expirationTime;
+    private @Nullable String tokenValue;
+    private @Nullable Date expirationTime;
     private List<String> scopes = new ArrayList<>();
 
     protected Builder() {}
@@ -157,34 +157,34 @@ protected Builder(AccessToken accessToken) {
       this.scopes = accessToken.getScopes();
     }
 
-    public String getTokenValue() {
+    public @Nullable String getTokenValue() {
       return this.tokenValue;
     }
 
     public List<String> getScopes() {
       return this.scopes;
     }
 
-    public Date getExpirationTime() {
+    public @Nullable Date getExpirationTime() {
       return this.expirationTime;
     }
 
     @CanIgnoreReturnValue
-    public Builder setTokenValue(String tokenValue) {
+    public Builder setTokenValue(@Nullable String tokenValue) {
       this.tokenValue = tokenValue;
       return this;
     }
 
     @CanIgnoreReturnValue
-    public Builder setScopes(String scopes) {
+    public Builder setScopes(@Nullable String scopes) {
       if (scopes != null && scopes.trim().length() > 0) {
         this.scopes = Arrays.asList(scopes.split(" "));
       }
       return this;
     }
 
     @CanIgnoreReturnValue
-    public Builder setScopes(List<String> scopes) {
+    public Builder setScopes(@Nullable List<String> scopes) {
       if (scopes == null) {
         this.scopes = new ArrayList<>();
       } else {
@@ -195,7 +195,7 @@ public Builder setScopes(List<String> scopes) {
     }
 
     @CanIgnoreReturnValue
-    public Builder setExpirationTime(Date expirationTime) {
+    public Builder setExpirationTime(@Nullable Date expirationTime) {
       this.expirationTime = expirationTime;
       return this;
     }

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/AppEngineCredentials.java

@@ -80,9 +80,10 @@ class AppEngineCredentials extends GoogleCredentials implements ServiceAccountSi
   private transient Method getExpirationTime;
   private transient Method signForApp;
   private transient Method getSignature;
-  private transient String account;
+  private transient @Nullable String account;
 
-  AppEngineCredentials(Collection<String> scopes, Collection<String> defaultScopes)
+  AppEngineCredentials(
+      @Nullable Collection<String> scopes, @Nullable Collection<String> defaultScopes)
       throws IOException {
     // Use defaultScopes only when scopes don't exist.
     if (scopes == null || scopes.isEmpty()) {
@@ -96,7 +97,7 @@ class AppEngineCredentials extends GoogleCredentials implements ServiceAccountSi
   }
 
   AppEngineCredentials(
-      Collection<String> scopes,
+      @Nullable Collection<String> scopes,
       @Nullable Collection<String> defaultScopes,
       AppEngineCredentials unscoped) {
     this.appIdentityService = unscoped.appIdentityService;
@@ -164,13 +165,13 @@ public boolean createScopedRequired() {
   }
 
   @Override
-  public GoogleCredentials createScoped(Collection<String> scopes) {
+  public GoogleCredentials createScoped(@Nullable Collection<String> scopes) {
     return new AppEngineCredentials(scopes, null, this);
   }
 
   @Override
   public GoogleCredentials createScoped(
-      Collection<String> scopes, Collection<String> defaultScopes) {
+      @Nullable Collection<String> scopes, @Nullable Collection<String> defaultScopes) {
     return new AppEngineCredentials(scopes, defaultScopes, this);
   }
 

google-auth-library-java/oauth2_http/java/com/google/auth/oauth2/CloudShellCredentials.java

@@ -135,6 +135,7 @@ public static class Builder extends GoogleCredentials.Builder {
     protected Builder() {}
 
     protected Builder(CloudShellCredentials credentials) {
+      super(credentials);
       this.authPort = credentials.authPort;
     }
 
@@ -144,9 +145,10 @@ public Builder setAuthPort(int authPort) {
       return this;
     }
 
+    @Override
     @CanIgnoreReturnValue
-    public Builder setQuotaProjectId(String quotaProjectId) {
-      super.quotaProjectId = quotaProjectId;
+    public Builder setQuotaProjectId(@Nullable String quotaProjectId) {
+      super.setQuotaProjectId(quotaProjectId);
       return this;
     }