When resolving a user's roles, if there are any roles that depend on DLS/FLS, and that is not permitted by the current license, we skip them.
https://github.com/elastic/elasticsearch/blob/f435488484ec844962d49371b8917c135fe6f714/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStore.java#L188-L192

However, we do not perform any logging in this circumstance, and rely on the user discovering that their roles are missing.

We should
1. Add a `WARN` log message
2. Add a Warning header

when this occurs. 
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStoreTests.java
fileRolesStore,
            nativeRolesStore,
            reservedRolesStore,
            mock(NativePrivilegeStore.class),
            null,
            mock(ApiKeyService.class),
            mock(ServiceAccountService.class),
            null,
            null
        );
        verify(fileRolesStore).addListener(anyConsumer()); 
        PlainActionFuture<Role> rolesFuture = new PlainActionFuture<>();
        final User user = new User("no role user");
        compositeRolesStore.getRole(new Subject(user, new RealmRef("name", "type", "node")), rolesFuture);
        final Role roles = rolesFuture.actionGet();
        assertEquals(Role.EMPTY, roles);
    }
    public void testAnonymousUserEnabledRoleAdded() {
        Settings settings = Settings.builder()
            .put(SECURITY_ENABLED_SETTINGS)
            .put(AnonymousUser.ROLES_SETTING.getKey(), "anonymous_user_role")
            .build();
        final FileRolesStore fileRolesStore = mock(FileRolesStore.class);
        doCallRealMethod().when(fileRolesStore).accept(anySet(), anyActionListener());
        final NativeRolesStore nativeRolesStore = mock(NativeRolesStore.class);
        doCallRealMethod().when(nativeRolesStore).accept(anySet(), anyActionListener());
        doAnswer(invocationOnMock -> {
            @SuppressWarnings("unchecked")
            Set<String> names = (Set<String>) invocationOnMock.getArguments()[0];
            if (names.size() == 1 && names.contains("anonymous_user_role")) {