The Past, Present, and Future of Null-Safety in Java