Switch use of `com.google.code.findbugs:jsr305` from `compile` scope to `compileOnly` scope, to prevent leaking as a transitive dependency