QL: IndexResolver issue when dealing with dotted fields

[costin]

Description

IndexResolver tries to create a tree structure for field names that contain dots (e.g. ECS) which can conflict with fields in other indices in which case all underlying fields end up being discarded as unsupported.

Consider field "file.name" as keyword in "index-1" and "file" as keyword in "index-2". This results in the following mapping from field caps:

"indices": ["index-1", "index-2"],
"fields":
{
 "file.name":
 {
  "keyword":
  {
   "type": "keyword",
   "metadata_field": false,
   "searchable": true,
   "aggregatable": true,
   "indices": ["index-1"]
  },
  "unmapped":
  {
   "type": "unmapped",
   "metadata_field": false,
   "searchable": false,
   "aggregatable": false,
   "indices": ["index-2"]
  }
 },
 "file":
 {
  "keyword":
  {
   "type": "keyword",
   "metadata_field": false,
   "searchable": true,
   "aggregatable": true,
   "indices": ["index-2"]
  },
  "object":
  {
   "type": "object",
   "metadata_field": false,
   "searchable": false,
   "aggregatable": false,
   "indices": ["index-1"]
  }
 }
}

Notice that file is mapped both as an object in index-1 and keyword in index-2. IndexResolver sees the conflict and thus discards as unsupported all the fields under it, including file.name hence why the ESQL query where file.name is not null fails.
When a projection is added where file.name is not null | keep file.name, IndexResolver doesn't ask the mapping information for file which removes the conflict and thus file.name can be resolved.

The main fix here is to NOT discard fields under an object leaf as unsupported if they have no conflict. In this example file.name is mapped as keyword in one index and unmapped in the other so across all indices it will have the same type.
Furthermore listing the field as missing instead of say unsupported is incorrect.

[elasticsearchmachine]

Pinging @elastic/es-ql (Team:QL)

[elasticsearchmachine]

Pinging @elastic/elasticsearch-esql (:Query Languages/ES|QL)

[astefan]

listing the field as missing instead of say unsupported is incorrect

This should only be valid for ESQL. SQL hides these fields.
There's also the use case of show columns where these fields should be displayed.