### Elasticsearch Version

main

### Installed Plugins

_No response_

### Java Version

_bundled_

### OS Version

all

### Problem Description

Do this

### Steps to Reproduce

```
rm /tmp/evil
for a in {0..9}; do
   for b in {0..9}; do
      echo '{"index": {}}' >> /tmp/evil
      echo '{"a": '$a', "b": '$b'}' >> /tmp/evil
   done
done
echo >> /tmp/evil

curl -uelastic:password -XDELETE localhost:9200/test
curl -HContent-Type:application/json -uelastic:password -XPUT localhost:9200/test
curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/test/_bulk --data-binary @/tmp/evil
curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/test/_forcemerge?max_num_segments=1
curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/test/_refresh

curl -HContent-Type:application/json -uelastic:password -XPOST localhost:9200/_esql?pretty -d'{
   "query": "FROM test | STATS MAX(a) BY a, b | KEEP a"
}'
```

### Logs (if relevant)

_No response_
x-pack/plugin/esql/compute/src/test/java/org/elasticsearch/compute/operator/ProjectOperatorTests.java
var shouldBeSetInMask = block.getInt(0);
            assertTrue(mask.get(shouldBeSetInMask));
            lastSetIndex = mask.nextSetBit(lastSetIndex + 1);
            assertEquals(shouldBeSetInMask, lastSetIndex);
            block.close();
        }
    }
    private BitSet randomMask(int size) {
        var mask = new BitSet(size);
        for (int i = 0; i < size; i++) {
            mask.set(i, randomBoolean());
        }
        return mask;
    }
    @Override
    protected SourceOperator simpleInput(int end) {
        return new TupleBlockSourceOperator(blockFactory, LongStream.range(0, end).mapToObj(l -> Tuple.tuple(l, end - l)));
    }
    @Override
    protected Operator.OperatorFactory simple(BigArrays bigArrays) {
        BitSet mask = new BitSet();
        mask.set(1, true);
        return new ProjectOperator.ProjectOperatorFactory(mask);
    }
    @Override
    protected String expectedDescriptionOfSimple() {
        return "ProjectOperator[mask = {1}]";
    }
    @Override
    protected String expectedToStringOfSimple() {