ESQL: Support exponential histograms in TS queries

[JonasKunz]

Adds support for querying exponential histograms in TS queries, e.g.:

TS exp_histo_sample 
 | WHERE TRANGE(to_datetime("2025-09-25T00:30:00Z"), to_datetime("2025-09-25T01:00:00Z"))
 | STATS min = MIN(responseTime),
         max = MAX(responseTime),
         median = MEDIAN(responseTime),
         p75 = PERCENTILE(responseTime,75),
         sum = SUM(responseTime),
         avg = AVG(responseTime) 
         BY instance, time=TBUCKET(10m)

The query above aggregates all histogram samples per bucket and yields the corresponding aggregation results.
This PR implements this behaviour by ensuring that we use a hidden merge_over_time inner aggregate function when the queried field is of type exponential_histogram.

This PR does not handle other _over_time functions yet (e.g. last_over_time).
This will be fixed in a follow-up PR.

[elasticsearchmachine]

Pinging @elastic/es-analytical-engine (Team:Analytics)

[JonasKunz]

Release tests seem to be failing for an unrelated reason, so I'm removing the tag again.

[kkrik-es]

What's the type of the inner field? I wonder if we should generalize this, having a loop that keeps unrolling fields until it finds a real field.

[JonasKunz]

In this instanceof case we know that it must be an actual field:
ExtractHistogramComponent is a function which only accepts exponential_histogram-typed values as first parameter. The only way to get one is either a Merge aggregation (which is impossible here because we are alread in an aggregation) or a field reference.

I tried to outline the general solution for this problem in the comment above:

// One possible strategy would be to search for all field references in the expression.
// Then check if there is TimeSeriesAggregateFunction on the path to the outer aggregation (in the chain of parents).
// If not, wrap the field reference with the appropriate TimeSeriesAggregateFunction based on its type

This would be the general solution where we don't need to know all the intermediate expressions and which also works if multiple fields (e.g. SUM(gaugeA + gaugeB) are involved.

Should I create an issue for this?

[dnhatn]

I opened #138702

[kkrik-es]

Cute! Please wait for Nhat too.

[dnhatn]

LGTM, thanks Jonas!