### Elasticsearch Version

main

### Installed Plugins

_No response_

### Java Version

_bundled_

### OS Version

all

### Problem Description

Do this

### Steps to Reproduce

```
rm /tmp/evil
for a in {0..9}; do
   for b in {0..9}; do
      echo '{"index": {}}' >> /tmp/evil
      echo '{"a": '$a', "b": '$b'}' >> /tmp/evil
   done
done
echo >> /tmp/evil

curl -uelastic:password -XDELETE localhost:9200/test
curl -HContent-Type:application/json -uelastic:password -XPUT localhost:9200/test
curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/test/_bulk --data-binary @/tmp/evil
curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/test/_forcemerge?max_num_segments=1
curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/test/_refresh

curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/_esql?pretty -d'{
   "query": "FROM test | STATS MAX(a) BY a, b | KEEP a"
}'
```

### Logs (if relevant)

_No response_
x-pack/plugin/esql/compute/src/main/java/org/elasticsearch/compute/operator/ProjectOperator.java
if (blocks == null) {
            blocks = new Block[bs.cardinality()];
        }
        Arrays.fill(blocks, null);
        int b = 0;
        int positionCount = page.getPositionCount();
        List<Releasable> blocksToRelease = new ArrayList<>();
        for (int i = 0; i < page.getBlockCount(); i++) {
            var block = page.getBlock(i);
            if (bs.get(i)) {
                assertNotReleasing(blocksToRelease, block);
                blocks[b++] = block;
            } else {
                blocksToRelease.add(block);
            }
        }
        Releasables.close(blocksToRelease);
        return new Page(positionCount, blocks);
    }
    @Override
    public String toString() {
        return "ProjectOperator[mask = " + bs + ']';
    }
    static void assertNotReleasing(List<Releasable> toRelease, Block toKeep) {
        
        assert toRelease.stream().anyMatch(r -> r == toKeep) == false
            : "both releasing and keeping the same block: " + toRelease.stream().filter(r -> r == toKeep).toList();
    }
}