Update JSR305 to 3.0

Currently this artifact is listed as dependency to Google Guice. This
is wrong: it's not used by Guice, but by closure-templates. However,
it's also used directly by gitiles-servlet, so put it in the
top-level lib package. (In general we have dependencies in lib
subpackages if they are used directly only within that package.)

Change-Id: I5ab10ed2c0f92d41d358b0a184d9e3777cc1d67a

lib/BUCK

diff --git a/lib/BUCK b/lib/BUCK
index 2b66a3f..d0e679d 100644
--- a/lib/BUCK
+++ b/lib/BUCK
@@ -29,6 +29,13 @@
 )
 
 maven_jar(
+  name = 'jsr305',
+  id = 'com.google.code.findbugs:jsr305:3.0.0',
+  sha1 = '5871fb60dc68d67da54a663c3fd636a10a532948',
+  attach_source = False,
+)
+
+maven_jar(
   name = 'gson',
   id = 'com.google.code.gson:gson:2.1',
   sha1 = '2e66da15851f9f5b5079228f856c2f090ba98c38',