fix(es): `.`, `..`, and empty index names silently widen requests to the whole cluster

[margaretjgu]

encodePathParam in src/es/request-builder.ts percent-encodes /, ?, # (per #106), but leaves ., .., and "" untouched. fetch then normalizes those segments away, so the request targets the cluster root instead of an index.

Reproduced against Elasticsearch 9.4.4 (start-local), two indices seeded:

elastic stack es search --index public-index   -> hits from ['public-index']
elastic stack es search --index ..             -> hits from ['public-index', 'secret-index']
elastic stack es search --index .              -> hits from ['public-index', 'secret-index']
elastic stack es search --index ""             -> hits from ['public-index', 'secret-index']

The user asked for one index and got documents from every index. There is no error and no warning, so the widened scope is not visible from the output.

indices delete --index .. likewise sends DELETE /. Elasticsearch rejects that with action_request_validation_exception, so there is no data loss, but the target is still silently rewritten client-side.

src/lib/sanitize.ts:106 already treats . and .. as reserved index names, and sanitizeIndexName has test coverage. That logic is not wired into the request path.

Suggested fix: reject path-param segments that are empty, ., or .. in encodePathParam rather than passing them through.

Test plan

• Unit test in test/es/request-builder.test.ts asserting ., .., and "" path params throw
• Same for test/cloud/request-builder.test.ts (shares the encoding approach)
• Regression test that a valid multi-target value like idx1,idx2 still passes through