Before this PR

FLUP to #278

Our mental model of a BugChecker is

• Uses the suppression mechanisms built into error-prone (e.g. not descending into the BugChecker at all, or using SuppressibleTreePathScanner)
• A fix is always preferable to a suppression

Some checkers break this

• RemoveUnused was overzealously removing instances of StrictUnusedVariable and NullAway. This is because they roll their own suppression checking, which don't respect -XoptIgnoreSuppressionAnnotations
• RemoveUnused + Apply mode was autofixing suppressed instances of SafeLoggingPropagation by adding @DoNotLog and @Unsafe. However, these human-added suppressions are vetted and deliberate. The autofix downgrades the log-safety of the affected methods, which is undesireable

After this PR

Add the SuppressibleErrorProne:PreferKeepingExistingSuppression option, so removeUnused mode will shunt

• Checks which behave in weird ways
• Checks whose autofixes aren't desirable (should be the minority)

==COMMIT_MSG==
Add the preferKeepingExistingSuppression extension option to shunt removeUnused mode for non-standard checks
==COMMIT_MSG==

Possible downsides?

If we want to be extra safe, we can make removeUnused only remove rollout suppressions. This should be a small code change.

I am leaning towards preferring autofixes as the default. We should roll this out with a background excavator to discover more rogue/undesireable fixes before integrating this into our upgrade infrastructure.