When resolving a user's roles, if there are any roles that depend on DLS/FLS, and that is not permitted by the current license, we skip them.
https://github.com/elastic/elasticsearch/blob/f435488484ec844962d49371b8917c135fe6f714/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStore.java#L188-L192

However, we do not perform any logging in this circumstance, and rely on the user discovering that their roles are missing.

We should
1. Add a `WARN` log message
2. Add a Warning header

when this occurs. 
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/RoleDescriptorStore.java
bwcApiKeyRoleReference.getRoleType()
        );
        final RolesRetrievalResult rolesRetrievalResult = new RolesRetrievalResult();
        rolesRetrievalResult.addDescriptors(Set.copyOf(roleDescriptors));
        listener.onResponse(rolesRetrievalResult);
    }
    @Override
    public void resolveServiceAccountRoleReference(
        RoleReference.ServiceAccountRoleReference roleReference,
        ActionListener<RolesRetrievalResult> listener
    ) {
        serviceAccountService.getRoleDescriptorForPrincipal(roleReference.getPrincipal(), listener.map(roleDescriptor -> {
            final RolesRetrievalResult rolesRetrievalResult = new RolesRetrievalResult();
            rolesRetrievalResult.addDescriptors(Set.of(roleDescriptor));
            return rolesRetrievalResult;
        }));
    }
    private void resolveRoleNames(Set<String> roleNames, ActionListener<RolesRetrievalResult> listener) {
        roleDescriptors(roleNames, ActionListener.wrap(rolesRetrievalResult -> {
            logDeprecatedRoles(rolesRetrievalResult.getRoleDescriptors());
            final boolean missingRoles = rolesRetrievalResult.getMissingRoles().isEmpty() == false;
            if (missingRoles) {
                logger.debug(() -> new ParameterizedMessage("Could not find roles with names {}", rolesRetrievalResult.getMissingRoles()));
            }
            final Set<RoleDescriptor> effectiveDescriptors;
            Set<RoleDescriptor> roleDescriptors = rolesRetrievalResult.getRoleDescriptors();
            if (roleDescriptors.stream().anyMatch(RoleDescriptor::isUsingDocumentOrFieldLevelSecurity)
                && DOCUMENT_LEVEL_SECURITY_FEATURE.checkWithoutTracking(licenseState) == false) {
                effectiveDescriptors = roleDescriptors.stream()
                    .filter(not(RoleDescriptor::isUsingDocumentOrFieldLevelSecurity))