When resolving a user's roles, if there are any roles that depend on DLS/FLS, and that is not permitted by the current license, we skip them.
https://github.com/elastic/elasticsearch/blob/f435488484ec844962d49371b8917c135fe6f714/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStore.java#L188-L192

However, we do not perform any logging in this circumstance, and rely on the user discovering that their roles are missing.

We should
1. Add a `WARN` log message
2. Add a Warning header

when this occurs. 
x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/RoleDescriptorStore.java
if (roleNames.isEmpty()) {
            listener.onResponse(RolesRetrievalResult.EMPTY);
        } else if (roleNames.equals(Set.of(ReservedRolesStore.SUPERUSER_ROLE_DESCRIPTOR.getName()))) {
            listener.onResponse(RolesRetrievalResult.SUPERUSER);
        } else {
            resolveRoleNames(roleNames, listener);
        }
    }
    @Override
    public void resolveApiKeyRoleReference(
        RoleReference.ApiKeyRoleReference apiKeyRoleReference,
        ActionListener<RolesRetrievalResult> listener
    ) {
        final List<RoleDescriptor> roleDescriptors = apiKeyService.parseRoleDescriptorsBytes(
            apiKeyRoleReference.getApiKeyId(),
            apiKeyRoleReference.getRoleDescriptorsBytes(),
            apiKeyRoleReference.getRoleType()
        );
        final RolesRetrievalResult rolesRetrievalResult = new RolesRetrievalResult();
        rolesRetrievalResult.addDescriptors(Set.copyOf(roleDescriptors));
        listener.onResponse(rolesRetrievalResult);
    }
    @Override
    public void resolveBwcApiKeyRoleReference(
        RoleReference.BwcApiKeyRoleReference bwcApiKeyRoleReference,
        ActionListener<RolesRetrievalResult> listener
    ) {
        final List<RoleDescriptor> roleDescriptors = apiKeyService.parseRoleDescriptors(
            bwcApiKeyRoleReference.getApiKeyId(),
            bwcApiKeyRoleReference.getRoleDescriptorsMap(),