Make use of clang nullability attributes.

Replace uses of the GCC nonnull attribute with the clang nullability
qualifiers. The replacement should be transparent for clang developers as
the new qualifiers will produce the same warnings and will be useful for
static checkers but will not cause aggressive optimizations.

GCC will not produce such warnings and developers will have to use
upgraded GCC ports built with the system headers from r312538.

Hinted by: Apple's Libc-1158.20.4, Bionic libc
MFC after: 11.1 Release

Differential Revision: https://reviews.freebsd.org/D9004