ES|QL Ad Hoc Joins: Join any index without pre-configuration

## Value Proposition

Today's join methods (LOOKUP JOIN and ENRICH) require pre-configured lookup indices or enrich policies and cannot handle large streaming datasets like logs and traces. Security analysts and SREs investigating incidents need to correlate data across arbitrary indices on the fly without setup friction.

## Expected Outcome

An ES|QL JOIN command that works against any index or data stream — no special index types, no prior setup. Users can perform inner, outer, and subsearch joins to correlate logs, traces, metrics, and reference data in a single query.