##### SUMMARY
Support become unprivileged user on macOS without `allow_world_readable_tmpfiles=true`

##### ISSUE TYPE
- Feature Idea

##### COMPONENT NAME
action, shell, and copy

##### ADDITIONAL INFORMATION
When using become where the login user and the become user are both unprivileged, Ansible attempts to securely change file permissions to only allow the become user to read the files. It uses `setfacl` and falls back to `chown`. Both of these fail on macOS, as there is no `setfacl` command and `chown` is not permitted.

macOS actually does provide the same functionality as `setfacl`, using `chmod +a`. The syntax is a bit different from `setfacl`, but it should be able to do what Ansible needs.
module_args['_ansible_diff'] = self._play_context.diff
        
        module_args['_ansible_verbosity'] = display.verbosity
        
        module_args['_ansible_version'] = __version__
        
        module_args['_ansible_module_name'] = module_name
        
        module_args['_ansible_syslog_facility'] = task_vars.get('ansible_syslog_facility', C.DEFAULT_SYSLOG_FACILITY)
        
        module_args['_ansible_selinux_special_fs'] = C.DEFAULT_SELINUX_SPECIAL_FS
        
        module_args['_ansible_string_conversion_action'] = C.STRING_CONVERSION_ACTION
        
        module_args['_ansible_socket'] = getattr(self._connection, 'socket_path')
        if not module_args['_ansible_socket']:
            module_args['_ansible_socket'] = task_vars.get('ansible_socket')
        
        module_args['_ansible_shell_executable'] = self._play_context.executable
        
        module_args['_ansible_keep_remote_files'] = C.DEFAULT_KEEP_REMOTE_FILES
        
        if self._is_become_unprivileged():  
            module_args['_ansible_tmpdir'] = None
        else:
            module_args['_ansible_tmpdir'] = self._connection._shell.tmpdir
        
        module_args['_ansible_remote_tmp'] = self.get_shell_option('remote_tmp', default='~/.ansible/tmp')
    def _execute_module(self, module_name=None, module_args=None, tmp=None, task_vars=None, persist_files=False, delete_remote_tmp=None, wrap_async=False):