When resolving a user's roles, if there are any roles that depend on DLS/FLS, and that is not permitted by the current license, we skip them.
https://github.com/elastic/elasticsearch/blob/f435488484ec844962d49371b8917c135fe6f714/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStore.java#L188-L192

However, we do not perform any logging in this circumstance, and rely on the user discovering that their roles are missing.

We should
1. Add a `WARN` log message
2. Add a Warning header

when this occurs. 
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStoreTests.java
assertThat(role.checkClusterAction("cluster:admin/foo", Empty.INSTANCE, mock(Authentication.class)), is(false));
        assertThat(effectiveRoleDescriptors.get(), is(nullValue()));
        if (version == Version.CURRENT) {
            verify(apiKeyService).parseRoleDescriptorsBytes(
                apiKeyId,
                (BytesReference) authentication.getMetadata().get(API_KEY_ROLE_DESCRIPTORS_KEY),
                RoleReference.ApiKeyRoleType.ASSIGNED
            );
            verify(apiKeyService).parseRoleDescriptorsBytes(
                apiKeyId,
                (BytesReference) authentication.getMetadata().get(API_KEY_LIMITED_ROLE_DESCRIPTORS_KEY),
                RoleReference.ApiKeyRoleType.LIMITED_BY
            );
        } else {
            verify(apiKeyService).parseRoleDescriptors(
                apiKeyId,
                (Map<String, Object>) authentication.getMetadata().get(API_KEY_ROLE_DESCRIPTORS_KEY),
                RoleReference.ApiKeyRoleType.ASSIGNED
            );
            verify(apiKeyService).parseRoleDescriptors(
                apiKeyId,
                (Map<String, Object>) authentication.getMetadata().get(API_KEY_LIMITED_ROLE_DESCRIPTORS_KEY),
                RoleReference.ApiKeyRoleType.LIMITED_BY
            );
        }
        assertThat(role.names().length, is(1));
        assertThat(role.names()[0], containsString("user_role_"));
    }
    public void testGetRolesForRunAs() {
        final ApiKeyService apiKeyService = mock(ApiKeyService.class);