Add doc for agg_over_time

Author: dnhatn

docs/reference/query-languages/esql/_snippets/functions/description/max_over_time.md

@@ -167,9 +167,13 @@ null                                     | three       | 2024-05-10T00:01:00.000
 
 
 max_over_time
+
 required_capability: metrics_command
 required_capability: max_over_time
-TS k8s | STATS cost=sum(max_over_time(network.cost)) BY cluster, time_bucket = bucket(@timestamp,1minute) | SORT cost DESC, time_bucket DESC, cluster | LIMIT 10;
+// tag::max_over_time[]
+TS k8s | STATS cost=sum(max_over_time(network.cost)) BY cluster, time_bucket = bucket(@timestamp,1minute) 
+// tag::max_over_time[]
+| SORT cost DESC, time_bucket DESC, cluster | LIMIT 10;
 
 cost:double | cluster:keyword | time_bucket:datetime    
 32.75       | qa              | 2024-05-10T00:17:00.000Z

docs/reference/query-languages/esql/_snippets/functions/examples/max_over_time.md

@@ -21,6 +21,13 @@ public enum FunctionType {
      * For example, {@code MAX} in {@code | STATS MAX(LENGTH(string))}.
      */
     AGGREGATE,
+
+    /**
+     * Functions that can only appear in the aggregate" position of a {@code STATS}
+     * started with TS.
+     * For example, {@code MAX_OVER_TIME} in {@code | STATS MAX(MAX_OVER_TIME(string))}.
+     */
+    TIME_SERIES_AGGREGATE,
     /**
      * Functions that can only appear in the "grouping" position of a {@code STATS}.
      * For example, {@code CATEGORIZE} in {@code | STATS MAX(a) BY CATEGORIZE(message)}.