When resolving a user's roles, if there are any roles that depend on DLS/FLS, and that is not permitted by the current license, we skip them.
https://github.com/elastic/elasticsearch/blob/f435488484ec844962d49371b8917c135fe6f714/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStore.java#L188-L192

However, we do not perform any logging in this circumstance, and rely on the user discovering that their roles are missing.

We should
1. Add a `WARN` log message
2. Add a Warning header

when this occurs. 
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStoreTests.java
"fls",
            null,
            new IndicesPrivileges[] {
                IndicesPrivileges.builder()
                    .grantedFields("*")
                    .deniedFields("L1.*", "L2.*")
                    .indices("*")
                    .privileges("read")
                    .query("{ \"match\": {\"eventType.typeCode\": \"foo\"} }")
                    .build() },
            null
        );
        RoleDescriptor addsL1Fields = new RoleDescriptor(
            "dls",
            null,
            new IndicesPrivileges[] {
                IndicesPrivileges.builder()
                    .indices("*")
                    .grantedFields("L1.*")
                    .privileges("read")
                    .query("{ \"match\": {\"eventType.typeCode\": \"foo\"} }")
                    .build() },
            null
        );
        FieldPermissionsCache cache = new FieldPermissionsCache(Settings.EMPTY);
        PlainActionFuture<Role> future = new PlainActionFuture<>();
        CompositeRolesStore.buildRoleFromDescriptors(
            Sets.newHashSet(flsRole, addsL1Fields),
            cache,
            null,