### Elasticsearch Version

main

### Installed Plugins

_No response_

### Java Version

_bundled_

### OS Version

all

### Problem Description

Do this

### Steps to Reproduce

```
rm /tmp/evil
for a in {0..9}; do
   for b in {0..9}; do
      echo '{"index": {}}' >> /tmp/evil
      echo '{"a": '$a', "b": '$b'}' >> /tmp/evil
   done
done
echo >> /tmp/evil

curl -uelastic:password -XDELETE localhost:9200/test
curl -HContent-Type:application/json -uelastic:password -XPUT localhost:9200/test
curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/test/_bulk --data-binary @/tmp/evil
curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/test/_forcemerge?max_num_segments=1
curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/test/_refresh

curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/_esql?pretty -d'{
   "query": "FROM test | STATS MAX(a) BY a, b | KEEP a"
}'
```

### Logs (if relevant)

_No response_
x-pack/plugin/esql/qa/testFixtures/src/main/java/org/elasticsearch/xpack/esql/CsvTestUtils.java
private static final int MAX_WIDTH = 20;
    private static final CsvPreference CSV_SPEC_PREFERENCES = new CsvPreference.Builder('"', '|', "\r\n").build();
    private static final String NULL_VALUE = "null";
    private CsvTestUtils() {}
    public static boolean isEnabled(String testName) {
        return testName.endsWith("-Ignore") == false;
    }
    public static Tuple<Page, List<String>> loadPageFromCsv(URL source) throws Exception {
        record CsvColumn(String name, Type type, BuilderWrapper builderWrapper) {
            void append(String stringValue) {
                if (stringValue.contains(",")) {
                    builderWrapper().builder().beginPositionEntry();
                    String[] arrayOfValues = delimitedListToStringArray(stringValue, ",");
                    List<Object> convertedValues = new ArrayList<>(arrayOfValues.length);
                    for (String value : arrayOfValues) {
                        convertedValues.add(type.convert(value));
                    }
                    convertedValues.stream().sorted().forEach(v -> builderWrapper().append().accept(v));
                    builderWrapper().builder().endPositionEntry();
                    return;
                }
                var converted = stringValue.length() == 0 ? null : type.convert(stringValue);
                builderWrapper().append().accept(converted);
            }
        }
        CsvColumn[] columns = null;
        try (BufferedReader reader = org.elasticsearch.xpack.ql.TestUtils.reader(source)) {
            String line;