### Elasticsearch Version

main

### Installed Plugins

_No response_

### Java Version

_bundled_

### OS Version

all

### Problem Description

Do this

### Steps to Reproduce

```
rm /tmp/evil
for a in {0..9}; do
   for b in {0..9}; do
      echo '{"index": {}}' >> /tmp/evil
      echo '{"a": '$a', "b": '$b'}' >> /tmp/evil
   done
done
echo >> /tmp/evil

curl -uelastic:password -XDELETE localhost:9200/test
curl -HContent-Type:application/json -uelastic:password -XPUT localhost:9200/test
curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/test/_bulk --data-binary @/tmp/evil
curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/test/_forcemerge?max_num_segments=1
curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/test/_refresh

curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/_esql?pretty -d'{
   "query": "FROM test | STATS MAX(a) BY a, b | KEEP a"
}'
```

### Logs (if relevant)

_No response_
x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/action/EsqlQueryResponse.java
out.writeCollection(pages);
        out.writeBoolean(columnar);
    }
    public List<ColumnInfo> columns() {
        return columns;
    }
    List<Page> pages() {
        return pages;
    }
    public Iterator<Iterator<Object>> values() {
        return pagesToValues(columns.stream().map(ColumnInfo::type).toList(), pages);
    }
    public boolean columnar() {
        return columnar;
    }
    @Override
    public Iterator<? extends ToXContent> toXContentChunked(ToXContent.Params unused) {
        final BytesRef scratch = new BytesRef();
        final Iterator<? extends ToXContent> valuesIt;
        if (pages.isEmpty()) {
            valuesIt = Collections.emptyIterator();
        } else if (columnar) {
            valuesIt = Iterators.flatMap(
                Iterators.forRange(
                    0,
                    columns().size(),
                    column -> Iterators.concat(
                        Iterators.single(((builder, params) -> builder.startArray())),
                        Iterators.flatMap(pages.iterator(), page -> {
                            ColumnInfo.PositionToXContent toXContent = columns.get(column)