These are in some sense correct (begin()/end() can be null for empty spans), but
don't capture the critical contract that begin() is only null when end() is.
This leads to foreach loops over spans being considered unsafe.

Long-term we may want to express such constraints somehow, but for now giving
these pointers unknown nullability is the best we can do.

PiperOrigin-RevId: 591191038
Change-Id: I1f02e068a445c0ca5996a9212477b64393ef4161