build: enable Error Prone and NullAway (JSpecify) with aauth-signing fully @NullMarked

[marcofanti]

Closes the Error Prone/NullAway deferral from docs/PROGRESS.md.

• Error Prone 2.50.0 on main sources of both modules (tests compile plain). The required jdk.compiler add-exports/add-opens extend the existing .mvn/jvm.config. Findings fixed: locale-safe toLowerCase/split usage in SignatureBase and AAuthHeaders; ArrayRecordComponent suppressed with justification on records that intentionally carry raw byte[] (crypto/HTTP bytes, record equality unused).
• NullAway 0.13.8 in OnlyNullMarked mode with JSpecify 1.0.1. aauth-signing is fully @NullMarked: nullable parameters/returns annotated (@Nullable claim accessors, verifier helpers, exception constructors, JwksFetcher contract), and SignRequest/VerifyRequest builders now validate and normalize before constructing their records. Jwk gained a requiredStr helper so missing required JWK fields raise a clear IllegalArgumentException instead of an NPE.
• Next increment (documented): @NullMarked the aauth module package by package.

200 tests green; coverage gates met.

🤖 Generated with Claude Code