Send only the Referer's scheme and host to Sentry (closes #548)

A Sentry event kept the Referer header verbatim, and a Referer can be
an entrypoint URL: a sender that follows the README's http:// to
https:// redirect sends the URL it was redirected from, and a browser
sends the 404 page's URL under /h/ when it fetches that page's
stylesheet. The Sentry hook now keeps only the Referer's scheme and
host. The access log's reduction moves, unchanged, into a new package,
internal/referer, as SchemeAndHost; the access log and the Sentry hook
both call it there. The comment above sentryKeepsHeader and the
README's Sentry passage say so.

Model: opus-5-5

internal/server/sentry_test.go

@@ -325,6 +325,37 @@ func TestSentryScrub_ReplacesTheCapabilityPathWithTheRoutePattern(
 	)
 }
 
+// TestSentryScrub_KeepsOnlyTheRefererSchemeAndHost sends a receiver
+// request whose Referer is the entrypoint URL, as a sender's is after
+// it follows the README's redirect from http:// to https://. The event
+// keeps the Referer's scheme and host, and carries the UUID nowhere.
+func TestSentryScrub_KeepsOnlyTheRefererSchemeAndHost(t *testing.T) {
+	t.Parallel()
+
+	event := onlyEvent(t, sentryCase{
+		scrub:  true,
+		panics: true,
+		request: func(client *sentry.Client) *http.Request {
+			req := sentryReceiverRequest(client)
+			req.Header.Set(
+				"Referer",
+				"http://webhooker.example/h/"+sentryReceiverUUID,
+			)
+
+			return req
+		},
+	}.capture(t))
+
+	assert.NotContains(
+		t, marshalEvent(t, event), sentryReceiverUUID,
+	)
+	assert.Equal(
+		t,
+		"http://webhooker.example",
+		event.Request.Headers["Referer"],
+	)
+}
+
 // TestSentryScrub_KeepsTheRoutingContext checks the hook does not cost
 // the debugging signal: the route, its scheme and host, the method and
 // the metadata headers still identify what failed. On a static route