ESQL: Prototype FIRST/LAST (#132603)

Prototype implementation of FIRST and LAST. FIRST returns the value with the earliest timestamp. LAST returns the values with the latest timestamp.

Looks like:
```
FROM k8s
| STATS last_bytes_in = LAST(network.bytes_in, @timestamp) BY pod
| SORT pod ASC
```

SNAPSHOT only for now while we resolve the remaining open questions in #108385.

Important: FIRST/LAST in this PR only return a single value. In the example above, if the value of `network.bytes_in` with the latest `@timestamp` is `null` then we get the value with the next highest timestamp. If the value of `network.bytes_in` with the latest `@timestamp` is multivalued we'll get a random value from the top values. Some folks want that behavior, but surely not everyone. We'll figure out what it should do soon. But we can get this in under snapshot and folks can play with it.

In this prototype, if two documents tie in `@timestamp` then you'll get a value from one of them. Which one is undefined.

Author: nik9000