feat(seer): Detect GitLab bots in contributor seat tracking

[billyvg]

Summary

Seer code-review seat billing tracks merge-request authors via OrganizationContributors, and bot authors are filtered out by the is_bot property. That property only recognized GitHub's convention (alias ending in [bot], plus the Copilot special case), so GitLab bots and service accounts were counted as human contributors — consuming seats and able to trigger code reviews on bot-authored MRs.

GitLab's merge_request webhook payload exposes no bot flag (the user object is only {id, name, username, avatar_url, email}), so we detect bots from the username already persisted in alias, mirroring how GitHub detection already works.

What changed

• OrganizationContributors.is_bot now also matches GitLab's reserved bot/service-account username prefixes via GITLAB_BOT_USERNAME_RE:
  • project access token bots — project_{id}_bot_…
  • group access token bots — group_{id}_bot_…
  • service accounts — service_account_… / service_account_group_{id}_…
• New unit tests for is_bot covering GitHub bots, GitLab token/service-account bots, and human lookalikes (e.g. project_manager, my_project_42_bot_thing) that must not match.

Why this is safe / additive

GitHub usernames cannot contain underscores, while every GitLab bot pattern is underscore-laden — so teaching the shared is_bot property the GitLab patterns cannot misclassify a real GitHub login. GitHub behavior is unchanged, and no migration is needed because the GitLab username is already stored in alias by the seat-tracking processor.

Test plan

• pytest tests/sentry/models/test_organizationcontributors.py tests/sentry/seer/code_review/test_contributor_seats.py → 35 passed
• ruff clean; pre-commit hooks pass

Notes

• Strategy is username-pattern matching (no extra API call). GitLab's authoritative bot flag only exists on GET /users/:id, which we deliberately avoid to keep the webhook path synchronous and cheap.
• Out of scope: the seat-tracking seeding gaps tracked in SCM-99 (processor only fires on the open action and short-circuits when last_commit/author email is missing) are orthogonal to bot detection.