Send only the Referer's scheme and host to Sentry (closes #548)

A Sentry event kept the Referer header verbatim, and a Referer can be
an entrypoint URL: a sender that follows the README's http:// to
https:// redirect sends the URL it was redirected from, and a browser
sends the 404 page's URL under /h/ when it fetches that page's
stylesheet. The Sentry hook now keeps only the Referer's scheme and
host, through the access log's own reduction, which internal/middleware
now exports as RefererSchemeAndHost. The comment above
sentryKeepsHeader and the README's Sentry passage say so.

Model: opus-5-5

internal/middleware/middleware.go

@@ -48,8 +48,8 @@ const (
 	// pick the size of the line it writes.
 	redactedQuery = "?(redacted)"
 
-	// redactedReferer stands in for a Referer the access log cannot
-	// reduce to its scheme and host; see accessLogReferer.
+	// redactedReferer stands in for a Referer that cannot be reduced
+	// to its scheme and host; see RefererSchemeAndHost.
 	redactedReferer = "(redacted)"
 
 	// maxLogRequestIDBytes bounds the request id, which is also
@@ -342,15 +342,17 @@ func accessLogURL(r *http.Request, status int) string {
 	return pattern
 }
 
-// accessLogReferer returns the value for the access log's referer
-// field: the Referer's scheme and host, never its path or query. The
-// path can be an entrypoint URL, which carries the UUID: a sender that
-// follows a redirect from http:// to https:// sends the URL it was
-// redirected from, and a browser sends the 404 page's URL under /h/
-// when it fetches that page's stylesheet. A Referer without both a
-// scheme and a host is logged as redactedReferer.
-func accessLogReferer(r *http.Request) string {
-	referer := r.Referer()
+// RefererSchemeAndHost returns a Referer's scheme and host, never its
+// path or query. The path can be an entrypoint URL, which carries the
+// UUID: a sender that follows a redirect from http:// to https://
+// sends the URL it was redirected from, and a browser sends the 404
+// page's URL under /h/ when it fetches that page's stylesheet. A
+// Referer without both a scheme and a host comes back as
+// redactedReferer.
+//
+// It is the access log's referer field, and the Referer header the
+// Sentry hook in internal/server sends.
+func RefererSchemeAndHost(referer string) string {
 	if referer == "" {
 		return ""
 	}
@@ -413,7 +415,8 @@ func (s *Middleware) Logging() func(http.Handler) http.Handler {
 						requestID, maxLogRequestIDBytes,
 					),
 					"referer", logfield.Truncate(
-						accessLogReferer(r), logfield.MaxBytes,
+						RefererSchemeAndHost(r.Referer()),
+						logfield.MaxBytes,
 					),
 					"proto", r.Proto,
 					"remoteIP", RemoteIP(r),