When resolving a user's roles, if there are any roles that depend on DLS/FLS, and that is not permitted by the current license, we skip them.
https://github.com/elastic/elasticsearch/blob/f435488484ec844962d49371b8917c135fe6f714/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStore.java#L188-L192

However, we do not perform any logging in this circumstance, and rely on the user discovering that their roles are missing.

We should
1. Add a `WARN` log message
2. Add a Warning header

when this occurs. 
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStoreTests.java
limitedByRoleDescriptorBytes
            )
        );
        final PlainActionFuture<Role> future1 = new PlainActionFuture<>();
        compositeRolesStore.getRole(AuthenticationContext.fromAuthentication(authentication1).getAuthenticatingSubject(), future1);
        future1.actionGet();
        verify(apiKeyService).parseRoleDescriptorsBytes(apiKeyId, limitedByRoleDescriptorBytes, RoleReference.ApiKeyRoleType.LIMITED_BY);
        
        final User authenticatedUser2 = new User("elastic/some-service");
        final Authentication authentication2 = new Authentication(
            new User(new User(randomAlphaOfLengthBetween(3, 8)), authenticatedUser2),
            new RealmRef("_service_account", "_service_account", randomAlphaOfLength(8)),
            new RealmRef(randomAlphaOfLengthBetween(3, 8), randomAlphaOfLengthBetween(3, 8), randomAlphaOfLength(8)),
            Version.CURRENT,
            AuthenticationType.TOKEN,
            Map.of()
        );
        final PlainActionFuture<Role> future2 = new PlainActionFuture<>();
        doAnswer(invocation -> {
            @SuppressWarnings("unchecked")
            final ActionListener<RoleDescriptor> listener = (ActionListener<RoleDescriptor>) invocation.getArguments()[1];
            listener.onResponse(new RoleDescriptor(authenticatedUser2.principal(), null, null, null));
            return null;
        }).when(serviceAccountService).getRoleDescriptorForPrincipal(eq(authenticatedUser2.principal()), anyActionListener());
        compositeRolesStore.getRole(AuthenticationContext.fromAuthentication(authentication2).getAuthenticatingSubject(), future2);
        future2.actionGet();
        verify(serviceAccountService).getRoleDescriptorForPrincipal(eq(authenticatedUser2.principal()), anyActionListener());
    }
    public void testUsageStats() {
        final FileRolesStore fileRolesStore = mock(FileRolesStore.class);