feat(issues): Split search.group_index referrer by UI vs API

[mrduncan]

Issue search emitted a single search.group_index Snuba referrer for every request, blending UI (browser session) traffic with public API / integration traffic. Emit a distinct search.group_index.api referrer for token-authenticated requests so the two can be measured separately.

Gated behind the off-by-default organizations:search-group-index-api-referrer flag for a gradual rollout.

[sentry]

Bug: The sampling code path in calculate_hits() bypasses get_search_referrer(), relying on fragile string concatenation to create the referrer, which is inconsistent with the intended API vs. UI split logic.
_{Severity: MEDIUM}

Suggested Fix

Refactor the sampling code path in calculate_hits() to use the get_search_referrer() function to determine the base referrer before sampling is applied. This will ensure that both primary and sampling queries consistently use the same authentication-aware logic for splitting UI and API traffic.

Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: src/sentry/snuba/referrer.py#L799-L800

Potential issue: The sampling code path in `calculate_hits()` bypasses the
`get_search_referrer()` function, which is intended to differentiate referrers for UI
vs. API requests. Instead, it relies on simple string concatenation to append `_sample`
to the original referrer. While this currently works by coincidence, it creates a
semantic inconsistency and makes the code fragile. This bypass of the intended
authentication-aware logic could lead to metrics pollution if the sampling logic or
feature flag behavior is modified in the future, as it violates the PR's goal of
explicitly separating API and UI traffic.

_{Did we get this right? 👍 / 👎 to inform future reviews.}

[cvxluo]

i think we would also need to set this referrer in snuba like so: getsentry/snuba#7889, as otherwise it would have different rate limits than the original referrer.