Bonds linked to the world’s biggest oil company have ended up in ESG funds, highlighting a major flaw in how the sector is regulated.