When resolving a user's roles, if there are any roles that depend on DLS/FLS, and that is not permitted by the current license, we skip them.
https://github.com/elastic/elasticsearch/blob/f435488484ec844962d49371b8917c135fe6f714/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStore.java#L188-L192

However, we do not perform any logging in this circumstance, and rely on the user discovering that their roles are missing.

We should
1. Add a `WARN` log message
2. Add a Warning header

when this occurs. 
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStoreTests.java
when(xPackLicenseState.isAllowed(Security.CUSTOM_ROLE_PROVIDERS_FEATURE)).thenReturn(false);
        licenseListener.get().licenseStateChanged();
        roleNames = Sets.newHashSet("roleA");
        future = new PlainActionFuture<>();
        getRoleForRoleNames(compositeRolesStore, roleNames, future);
        role = future.actionGet();
        assertEquals(0, role.indices().groups().length);
        assertThat(effectiveRoleDescriptors.get(), hasSize(0));
        verify(xPackLicenseState, times(2)).disableUsageTracking(Security.CUSTOM_ROLE_PROVIDERS_FEATURE, "custom");
    }
    private SecurityIndexManager.State dummyState(ClusterHealthStatus indexStatus) {
        return dummyIndexState(true, indexStatus);
    }
    public SecurityIndexManager.State dummyIndexState(boolean isIndexUpToDate, ClusterHealthStatus healthStatus) {
        return new SecurityIndexManager.State(
            Instant.now(),
            isIndexUpToDate,
            true,
            true,
            null,
            concreteSecurityIndexName,
            healthStatus,
            IndexMetadata.State.OPEN,
            null,
            "my_uuid"
        );
    }
    public void testCacheClearOnIndexHealthChange() {
        final AtomicInteger numInvalidation = new AtomicInteger(0);
        FileRolesStore fileRolesStore = mock(FileRolesStore.class);