JSR-305 is a "Java Specification Request" to extend the specification. @Nullable
etc. were part of it; however it appears to be "dormant" (or frozen) ever since (See this SO question). So to use these annotations, you have to add the library yourself.
FindBugs was renamed to SpotBugs and is being developed under that name.
For maven this is the current annotation-only dependency (other integrations here):
<dependency>
<groupId>com.github.spotbugs</groupId>
<artifactId>spotbugs-annotations</artifactId>
<version>4.2.0</version>
</dependency>
If you wish to use the full plugin, refer to the documentation of SpotBugs.