On Maven side there is more or less standard net.jcip:jcip-annotations artifact to get jcip annotations. At least on Maven side it would be nicer to depend on it instead of embedding those classes since right now it duplicates those classes in the classloader when you have several projects that are using it.
Note that you can use separate artifact which contains jsr305 annotations only. Is this satisfactory for you, or you want something else?
Indeed I did not digg enough to notice that com.google.code.findbugs:annotations was just a a packaging of jcip-annotations and jsr305.
Sorry for the noise, you can probably close this issue.