security-crypto pulls in Tink, which references errorprone / JSR-305 / j2objc
annotations that aren't on the runtime classpath. R8 treats missing-class
references as errors by default, failing the release build. These are all
compile-only annotations; ignoring them is the standard Tink workaround.