##### SUMMARY
Support become unprivileged user on macOS without `allow_world_readable_tmpfiles=true`

##### ISSUE TYPE
- Feature Idea

##### COMPONENT NAME
action, shell, and copy

##### ADDITIONAL INFORMATION
When using become where the login user and the become user are both unprivileged, Ansible attempts to securely change file permissions to only allow the become user to read the files. It uses `setfacl` and falls back to `chown`. Both of these fail on macOS, as there is no `setfacl` command and `chown` is not permitted.

macOS actually does provide the same functionality as `setfacl`, using `chmod +a`. The syntax is a bit different from `setfacl`, but it should be able to do what Ansible needs.
''' consistently get the 'remote_user' for the action plugin '''
        
        
        remote_user = None
        try:
            remote_user = self._connection.get_option('remote_user')
        except KeyError:
            
            remote_user = getattr(self._connection, 'default_user', None) or self._play_context.remote_user
        except AttributeError:
            
            remote_user = self._play_context.remote_user
        return remote_user
    def _is_become_unprivileged(self):
        '''
        The user is not the same as the connection user and is not part of the
        shell configured admin users
        '''
        
        
        if not self._connection.become:
            return False
        
        
        admin_users = self._get_admin_users()
        remote_user = self._get_remote_user()
        become_user = self.get_become_option('become_user')
        return bool(become_user and become_user not in admin_users + [remote_user])
    def _make_tmp_path(self, remote_user=None):