When resolving a user's roles, if there are any roles that depend on DLS/FLS, and that is not permitted by the current license, we skip them.
https://github.com/elastic/elasticsearch/blob/f435488484ec844962d49371b8917c135fe6f714/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStore.java#L188-L192

However, we do not perform any logging in this circumstance, and rely on the user discovering that their roles are missing.

We should
1. Add a `WARN` log message
2. Add a Warning header

when this occurs. 
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStoreTests.java
final ServiceAccountService serviceAccountService = mock(ServiceAccountService.class);
        final CompositeRolesStore compositeRolesStore = buildCompositeRolesStore(
            Settings.EMPTY,
            null,
            null,
            null,
            null,
            null,
            apiKeyService,
            serviceAccountService,
            null,
            null
        );
        
        final String apiKeyId = randomAlphaOfLength(20);
        final BytesReference roleDescriptorBytes = new BytesArray("{}");
        final BytesReference limitedByRoleDescriptorBytes = new BytesArray("{\"a\":{\"cluster\":[\"all\"]}}");
        final User authenticatedUser1 = new User("authenticated_user");
        final Authentication authentication1 = new Authentication(
            new User(new User(randomAlphaOfLengthBetween(3, 8)), authenticatedUser1),
            new RealmRef("_es_api_key", "_es_api_key", randomAlphaOfLength(8)),
            new RealmRef(randomAlphaOfLengthBetween(3, 8), randomAlphaOfLengthBetween(3, 8), randomAlphaOfLength(8)),
            Version.CURRENT,
            AuthenticationType.API_KEY,
            Map.of(
                API_KEY_ID_KEY,
                apiKeyId,
                API_KEY_ROLE_DESCRIPTORS_KEY,
                roleDescriptorBytes,
                API_KEY_LIMITED_ROLE_DESCRIPTORS_KEY,