Bump Guava dependency to 24.1.1 (#536)
Bump Guava dependency to 24.1.1 (#536)

This is needed, as previous versions of Guava are subject to
CVE-2018-10237.

Note that the vulnerability occurs when decerializing untrusted data.
As such, it is hard to imagine a case where NullAway would be directly
exploitable, but we still shouldn't be asking build systems to
resolve a known-vulnerable version of the library.

Also, I'd love to bump Guava to a more modern version, but internally
we still need to be able to work with Guava 24.1.1, so setting that
as the minimum version seems the safest course of action right now.
uber/nullaway,uber/nullaway,uber/nullaway