When resolving a user's roles, if there are any roles that depend on DLS/FLS, and that is not permitted by the current license, we skip them.
https://github.com/elastic/elasticsearch/blob/f435488484ec844962d49371b8917c135fe6f714/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStore.java#L188-L192

However, we do not perform any logging in this circumstance, and rely on the user discovering that their roles are missing.

We should
1. Add a `WARN` log message
2. Add a Warning header

when this occurs. 
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStoreTests.java
verify(nativeRolesStore).accept(eq(Set.of(roleName)), anyActionListener());
        verify(nativeRolesStore).getRoleDescriptors(eq(Set.of(roleName)), anyActionListener());
        final int numberOfTimesToCall = scaledRandomIntBetween(0, 32);
        final boolean getSuperuserRole = randomBoolean()
            && roleName.equals(ReservedRolesStore.SUPERUSER_ROLE_DESCRIPTOR.getName()) == false;
        final Set<String> names = getSuperuserRole
            ? Sets.newHashSet(roleName, ReservedRolesStore.SUPERUSER_ROLE_DESCRIPTOR.getName())
            : Collections.singleton(roleName);
        for (int i = 0; i < numberOfTimesToCall; i++) {
            future = new PlainActionFuture<>();
            getRoleForRoleNames(compositeRolesStore, names, future);
            final Role role1 = future.actionGet();
            if (getSuperuserRole) {
                assertThat(role1.names(), arrayContaining("superuser"));
                final Collection<RoleDescriptor> descriptors = effectiveRoleDescriptors.get();
                assertThat(descriptors, hasSize(1));
                assertThat(descriptors.iterator().next().getName(), is("superuser"));
            } else {
                assertThat(effectiveRoleDescriptors.get(), is(nullValue()));
            }
        }
        if (numberOfTimesToCall > 0 && getSuperuserRole) {
            verify(nativePrivilegeStore).getPrivileges(eq(Set.of("*")), eq(Set.of("*")), anyActionListener());
            
            verify(reservedRolesStore, times(2)).accept(anySet(), anyActionListener());
        }
        verifyNoMoreInteractions(fileRolesStore, reservedRolesStore, nativeRolesStore, nativePrivilegeStore);
    }
    public void testNegativeLookupsCacheDisabled() {
        final FileRolesStore fileRolesStore = mock(FileRolesStore.class);