build: add -XDaddTypeAnnotationsToSymbol=true for Error Prone on JDK 21

Error Prone 2.27+ requires this javac flag on JDK 21 so type-use
annotations (JSpecify's @nullable, etc.) remain visible on symbols at
analysis time; without it Error Prone refuses to start with
"-XDaddTypeAnnotationsToSymbol=true is required by Error Prone on JDK 21".

Surfaced after Dependabot bumped Error Prone from 2.36.0 to 2.49.0.
See google/error-prone#4011

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: wolpert

build-logic/src/main/kotlin/pkauth.java-conventions.gradle.kts

@@ -29,7 +29,14 @@ tasks.withType<JavaCompile>().configureEach {
     // settings, and adapter modules may need to fine-tune lints per-module. The brief calls for
     // -Xlint:all -Werror on production modules — that gets layered on in library-conventions where
     // we know it is safe.
-    options.compilerArgs.addAll(listOf("-Xlint:all", "-parameters"))
+    //
+    // -XDaddTypeAnnotationsToSymbol=true is required by Error Prone 2.27+ on JDK 21 so that
+    // type-use annotations (e.g. JSpecify's @Nullable) are visible on symbols at analysis time.
+    // Without it Error Prone refuses to start. See
+    // https://github.com/google/error-prone/issues/4011
+    options.compilerArgs.addAll(
+        listOf("-Xlint:all", "-parameters", "-XDaddTypeAnnotationsToSymbol=true"),
+    )
     options.errorprone.disableWarningsInGeneratedCode = true
     // Default Error Prone check set, with one project-wide override:
     // pk-auth's wire contract is WebAuthn's, which is binary-heavy (challenge bytes, credential