When resolving a user's roles, if there are any roles that depend on DLS/FLS, and that is not permitted by the current license, we skip them.
https://github.com/elastic/elasticsearch/blob/f435488484ec844962d49371b8917c135fe6f714/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStore.java#L188-L192

However, we do not perform any logging in this circumstance, and rely on the user discovering that their roles are missing.

We should
1. Add a `WARN` log message
2. Add a Warning header

when this occurs. 
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStoreTests.java
callback.onFailure(exception);
            } else {
                callback.onResponse(RoleRetrievalResult.failure(exception));
            }
        };
        final Consumer<ActionListener<Collection<ApplicationPrivilegeDescriptor>>> privilegesHandler = callback -> callback.onResponse(
            Collections.emptyList()
        );
        final CompositeRolesStore compositeRolesStore = setupRolesStore(rolesHandler, privilegesHandler);
        trySuccessfullyLoadSuperuserRole(compositeRolesStore);
        if (criticalFailure) {
            
            tryFailOnNonSuperuserRole(compositeRolesStore, throwableWithMessage(containsString("native roles unavailable")));
        }
    }
    public void testSuperuserIsEffectiveWhenApplicationPrivilegesAreUnavailable() {
        final RoleDescriptor role = new RoleDescriptor(
            "_mock_role",
            new String[0],
            new IndicesPrivileges[0],
            new RoleDescriptor.ApplicationResourcePrivileges[] {
                RoleDescriptor.ApplicationResourcePrivileges.builder()
                    .application(randomAlphaOfLengthBetween(5, 12))
                    .privileges("all")
                    .resources("*")
                    .build() },
            new ConfigurableClusterPrivilege[0],
            new String[0],
            Map.of(),
            Map.of()