### Elasticsearch Version

main

### Installed Plugins

_No response_

### Java Version

_bundled_

### OS Version

all

### Problem Description

Do this

### Steps to Reproduce

```
rm /tmp/evil
for a in {0..9}; do
   for b in {0..9}; do
      echo '{"index": {}}' >> /tmp/evil
      echo '{"a": '$a', "b": '$b'}' >> /tmp/evil
   done
done
echo >> /tmp/evil

curl -uelastic:password -XDELETE localhost:9200/test
curl -HContent-Type:application/json -uelastic:password -XPUT localhost:9200/test
curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/test/_bulk --data-binary @/tmp/evil
curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/test/_forcemerge?max_num_segments=1
curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/test/_refresh

curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/_esql?pretty -d'{
   "query": "FROM test | STATS MAX(a) BY a, b | KEEP a"
}'
```

### Logs (if relevant)

_No response_
x-pack/plugin/esql/qa/testFixtures/src/main/java/org/elasticsearch/xpack/esql/CsvTestUtils.java
String typeName = nameWithType[1].trim();
                if (typeName.length() == 0) {
                    throw new IllegalArgumentException("A type is always expected in the csv file; found " + nameWithType);
                }
                String name = nameWithType[0].trim();
                columnNames.add(name);
                Type type = Type.asType(typeName);
                if (type == null) {
                    throw new IllegalArgumentException("Unknown type name: [" + typeName + "]");
                }
                columnTypes.add(type);
            }
            List<List<Object>> values = new ArrayList<>();
            List<String> row;
            while ((row = listReader.read()) != null) {
                List<Object> rowValues = new ArrayList<>(row.size());
                for (int i = 0; i < row.size(); i++) {
                    String value = row.get(i);
                    if (value == null || value.trim().equalsIgnoreCase(NULL_VALUE)) {
                        value = null;
                        rowValues.add(columnTypes.get(i).convert(value));
                        continue;
                    }
                    value = value.trim();
                    if (value.startsWith("[") ^ value.endsWith("]")) {
                        throw new IllegalArgumentException("Incomplete multi-value (opening and closing square brackets) found " + value);
                    }
                    if (value.contains(",") && value.startsWith("[")) {
                        List<Object> listOfMvValues = new ArrayList<>();
                        for (String mvValue : delimitedListToStringArray(value.substring(1, value.length() - 1), ",")) {