Use _Nullable instead of __nullable

Same for _Nonnull / __nonnull.

Apple implemented it as __nullable / __nonnull in their version of Clang
and sent that for upstreaming. My inital comments about this being a
potential problem and to better use _Nullable / _Nonnull had been
rejected as being too late, so I assumed it stayed that way. But
apparently, it has been changed to _Nullable / _Nonnull before the 3.7.0
release.