### Elasticsearch Version

main

### Installed Plugins

_No response_

### Java Version

_bundled_

### OS Version

all

### Problem Description

Do this

### Steps to Reproduce

```
rm /tmp/evil
for a in {0..9}; do
   for b in {0..9}; do
      echo '{"index": {}}' >> /tmp/evil
      echo '{"a": '$a', "b": '$b'}' >> /tmp/evil
   done
done
echo >> /tmp/evil

curl -uelastic:password -XDELETE localhost:9200/test
curl -HContent-Type:application/json -uelastic:password -XPUT localhost:9200/test
curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/test/_bulk --data-binary @/tmp/evil
curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/test/_forcemerge?max_num_segments=1
curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/test/_refresh

curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/_esql?pretty -d'{
   "query": "FROM test | STATS MAX(a) BY a, b | KEEP a"
}'
```

### Logs (if relevant)

_No response_
x-pack/plugin/esql/src/main/java/org/elasticsearch/xpack/esql/enrich/EnrichLookupService.java
private static Page createNullResponse(int positionCount, List<NamedExpression> extractFields) {
        final Block[] blocks = new Block[extractFields.size()];
        for (int i = 0; i < extractFields.size(); i++) {
            blocks[i] = Block.constantNullBlock(positionCount);
        }
        return new Page(blocks);
    }
    private static Operator droppingBlockOperator(int totalBlocks, int droppingPosition) {
        BitSet bitSet = new BitSet(totalBlocks);
        bitSet.set(0, totalBlocks);
        bitSet.clear(droppingPosition);
        return new ProjectOperator(bitSet);
    }
    private class TransportHandler implements TransportRequestHandler<LookupRequest> {
        @Override
        public void messageReceived(LookupRequest request, TransportChannel channel, Task task) {
            ActionListener<LookupResponse> listener = new ChannelActionListener<>(channel);
            doLookup(
                request.sessionId,
                (CancellableTask) task,
                request.shardId,
                request.matchType,
                request.matchField,
                request.inputPage,
                request.extractFields,
                listener.map(LookupResponse::new)
            );
        }
    }
    private static class LookupRequest extends TransportRequest implements IndicesRequest {