Fix ImmutableChecker to allow wildcard @ImmutableTypeParameters w…

…hich aren't provably immutable.

This is safe, as any instantiated object must have immutable type parameters.

Note: this is only true for `@ImmutableTypeParameter`, not `containerOf`! The latter is conditionally immutable, so we really do need to check the bound.

(And the corresponding change for ThreadSafe.)

PiperOrigin-RevId: 530601585

core/src/main/java/com/google/errorprone/bugpatterns/threadsafety/ThreadSafety.java

@@ -429,6 +429,11 @@ public Violation threadSafeInstantiation(
                   getPrettyName(type.tsym), typaram));
         }
         Type tyarg = type.getTypeArguments().get(i);
+        // Don't check whether wildcard types' erasure is safe. Wildcards can only be used where
+        // the type isn't being instantiated, and we can rely on instantiations all being checked.
+        if (immutableTypeParameter && tyarg instanceof WildcardType) {
+          continue;
+        }
         if (suppressAnnotation != null
             && tyarg.getAnnotationMirrors().stream()
                 .anyMatch(

core/src/test/java/com/google/errorprone/bugpatterns/threadsafety/ImmutableCheckerTest.java

@@ -811,6 +811,26 @@ public void mutableWildInstantiation() {
         .doTest();
   }
 
+  @Test
+  public void mutableWildcardInstantiation_immutableTypeParameter() {
+    compilationHelper
+        .addSourceLines(
+            "A.java",
+            "import com.google.errorprone.annotations.Immutable;",
+            "import com.google.errorprone.annotations.ImmutableTypeParameter;",
+            "@Immutable",
+            "class A<@ImmutableTypeParameter T> {}")
+        .addSourceLines(
+            "B.java",
+            "import com.google.errorprone.annotations.Immutable;",
+            "@Immutable",
+            "class B {",
+            "  private final A<?> a;",
+            "  public B(A<?> a) { this.a = a; }",
+            "}")
+        .doTest();
+  }
+
   @Test
   public void mutableRawType() {
     compilationHelper