feat(web-analytics): make heatmap chromium sandbox configurable

[Piccirello]

Gate the --no-sandbox launch flag for the local heatmap Chromium behind a new HEATMAP_CHROMIUM_NO_SANDBOX setting. Lets the sandbox be re-enabled per-environment once the runtime permits it.

[greptile-apps]

Prompt To Fix All With AI

Fix the following 1 code review issue. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 1
products/web_analytics/backend/tasks/test/test_heatmap_screenshot.py:564-574
The first test case passes an empty `overrides` dict, so `override_settings(**{})` is a no-op and `settings.HEATMAP_CHROMIUM_NO_SANDBOX` keeps whatever value was loaded from the process environment at Django startup. If `HEATMAP_CHROMIUM_NO_SANDBOX=false` is set in a developer's local `.env` or in a CI job, this case will fail unexpectedly — while the second case `("no_sandbox_enabled", True, True)` already explicitly tests the `True` branch. Either remove the first case (redundant once you have the explicit-`True` case) or, to specifically verify the compile-time default, assert the *settings default* separately rather than relying on the live environment.

```suggestion
    @parameterized.expand(
        [
            ("no_sandbox_enabled", True, True),
            ("no_sandbox_disabled", False, False),
        ]
    )
    def test_no_sandbox_flag_respects_setting(
        self, _name: str, setting_value: bool, should_include: bool
    ) -> None:
        overrides = {"HEATMAP_CHROMIUM_NO_SANDBOX": setting_value}
```

_{Reviews (1): Last reviewed commit: "feat(web-analytics): make heatmap chromi..." | Re-trigger Greptile}

[github-actions]

Simple, backwards-compatible configurability change with no production risk. The bot's unresolved concern about the first test case not explicitly pinning the setting to True is a minor test-robustness nit, not a showstopper.

[deployment-status-posthog]

Deploy status

Environment	Status	Deployed At	Workflow
dev	✅ Deployed	2026-06-02 16:31 UTC	Run
prod-us	✅ Deployed	2026-06-02 16:57 UTC	Run
prod-eu	✅ Deployed	2026-06-02 17:02 UTC	Run