When resolving a user's roles, if there are any roles that depend on DLS/FLS, and that is not permitted by the current license, we skip them.
https://github.com/elastic/elasticsearch/blob/f435488484ec844962d49371b8917c135fe6f714/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStore.java#L188-L192

However, we do not perform any logging in this circumstance, and rely on the user discovering that their roles are missing.

We should
1. Add a `WARN` log message
2. Add a Warning header

when this occurs. 
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStoreTests.java
assertThat(effectiveRoleDescriptors.get(), is(nullValue()));
        verify(apiKeyService).parseRoleDescriptorsBytes("key-id-1", roleBytes, RoleReference.ApiKeyRoleType.ASSIGNED);
        verify(apiKeyService).parseRoleDescriptorsBytes("key-id-1", limitedByRoleBytes, RoleReference.ApiKeyRoleType.LIMITED_BY);
        
        final Map<String, Object> metadata2 = new HashMap<>();
        metadata2.put(API_KEY_ID_KEY, "key-id-2");
        metadata2.put(AuthenticationField.API_KEY_NAME_KEY, randomBoolean() ? null : randomAlphaOfLengthBetween(1, 16));
        metadata2.put(AuthenticationField.API_KEY_ROLE_DESCRIPTORS_KEY, roleBytes);
        metadata2.put(AuthenticationField.API_KEY_LIMITED_ROLE_DESCRIPTORS_KEY, limitedByRoleBytes);
        authentication = new Authentication(
            new User("test api key user 2", "superuser"),
            new RealmRef("_es_api_key", "_es_api_key", "node"),
            null,
            Version.CURRENT,
            AuthenticationType.API_KEY,
            metadata2
        );
        roleFuture = new PlainActionFuture<>();
        compositeRolesStore.getRole(AuthenticationContext.fromAuthentication(authentication).getEffectiveSubject(), roleFuture);
        roleFuture.actionGet();
        assertThat(effectiveRoleDescriptors.get(), is(nullValue()));
        verify(apiKeyService, never()).parseRoleDescriptorsBytes(eq("key-id-2"), any(BytesReference.class), any());
        
        final BytesArray anotherRoleBytes = new BytesArray("{\"b role\": {\"cluster\": [\"manage_security\"]}}");
        final Map<String, Object> metadata3 = new HashMap<>();
        metadata3.put(API_KEY_ID_KEY, "key-id-3");
        metadata3.put(AuthenticationField.API_KEY_NAME_KEY, randomBoolean() ? null : randomAlphaOfLengthBetween(1, 16));
        metadata3.put(AuthenticationField.API_KEY_ROLE_DESCRIPTORS_KEY, anotherRoleBytes);
        metadata3.put(AuthenticationField.API_KEY_LIMITED_ROLE_DESCRIPTORS_KEY, limitedByRoleBytes);
        authentication = new Authentication(