JSpecify: bug with array contents annotations being copied by `javac`

[msridhar]

Example:

import org.jspecify.annotations.NullMarked;
import org.jspecify.annotations.Nullable;
@NullMarked
class Test {
  interface Consumer<T extends @Nullable Object> {
    void accept(T thing);
  }
  static class Util {
    static void take(String... thing) {
    }
    static void takeNullable(String @Nullable... thing) {
    }
    static void takeNullableArgs(@Nullable String... thing) {
    }
  }
  private <V extends @Nullable Object> void consume(Consumer<V> consumer, V value) {
    consumer.accept(value);
  }
  void testConsume(@Nullable String [] sNullableContents) {
    // should be illegal!
    consume(Util::take, sNullableContents);
    // should be illegal!
    consume(Util::takeNullable, sNullableContents);
  }
}

For both the consume calls, we end up passing in an array containing @Nullable Strings to a function expecting an array containing @NonNull Strings, which we should reject. I think the missed warning is because javac infers the type Consumer<@Nullable String[]> for the method references at the call sites, copying over the annotation from the other argument. NullAway needs to "undo" that annotation when it does its inference. This is vaguely related to #1453, but a different issue that seems specific to arrays.