Add OF_NONNULL / OF_NULLABLE and use that instead

Using __nonnull directly doesn't work on systems using glibc, as glibc
defines __nonnull as a parameterized define. While this does not fix the
problem of Clang introducing __nonnull even though it conflicts with
glibc, this at least means it's possible again to compile things with
versions of Clang that don't support __nonnull on systems with glibc.