Update JSR305 to 3.0

Currently this artifact is listed as dependency to Google Guice. This
is wrong: it's not used by Guice, but by closure-templates. However,
it's also used directly by gitiles-servlet, so put it in the
top-level lib package. (In general we have dependencies in lib
subpackages if they are used directly only within that package.)

Change-Id: I5ab10ed2c0f92d41d358b0a184d9e3777cc1d67a