When resolving a user's roles, if there are any roles that depend on DLS/FLS, and that is not permitted by the current license, we skip them.
https://github.com/elastic/elasticsearch/blob/f435488484ec844962d49371b8917c135fe6f714/x-pack/plugin/security/src/main/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStore.java#L188-L192

However, we do not perform any logging in this circumstance, and rely on the user discovering that their roles are missing.

We should
1. Add a `WARN` log message
2. Add a Warning header

when this occurs. 
x-pack/plugin/security/src/test/java/org/elasticsearch/xpack/security/authz/store/CompositeRolesStoreTests.java
new IndicesPrivileges[] { IndicesPrivileges.builder().privileges("READ").indices("foo").grantedFields("*").build() },
            null
        );
        final InMemoryRolesProvider inMemoryProvider1 = spy(new InMemoryRolesProvider((roles) -> {
            Set<RoleDescriptor> descriptors = new HashSet<>();
            if (roles.contains("roleA")) {
                descriptors.add(roleAProvider1);
            }
            return RoleRetrievalResult.success(descriptors);
        }));
        final RoleDescriptor roleBProvider2 = new RoleDescriptor(
            "roleB",
            null,
            new IndicesPrivileges[] { IndicesPrivileges.builder().privileges("READ").indices("bar").grantedFields("*").build() },
            null
        );
        final InMemoryRolesProvider inMemoryProvider2 = spy(new InMemoryRolesProvider((roles) -> {
            Set<RoleDescriptor> descriptors = new HashSet<>();
            if (roles.contains("roleA")) {
                
                
                descriptors.add(
                    new RoleDescriptor(
                        "roleA",
                        null,
                        new IndicesPrivileges[] { IndicesPrivileges.builder().privileges("WRITE").indices("*").grantedFields("*").build() },
                        null
                    )
                );
            }