##### SUMMARY
Support become unprivileged user on macOS without `allow_world_readable_tmpfiles=true`

##### ISSUE TYPE
- Feature Idea

##### COMPONENT NAME
action, shell, and copy

##### ADDITIONAL INFORMATION
When using become where the login user and the become user are both unprivileged, Ansible attempts to securely change file permissions to only allow the become user to read the files. It uses `setfacl` and falls back to `chown`. Both of these fail on macOS, as there is no `setfacl` command and `chown` is not permitted.

macOS actually does provide the same functionality as `setfacl`, using `chmod +a`. The syntax is a bit different from `setfacl`, but it should be able to do what Ansible needs.
"""
        We need the files we upload to be readable (and sometimes executable)
        by the user being sudo'd to but we want to limit other people's access
        (because the files could contain passwords or other private
        information.  We achieve this in one of these ways:
        * If no sudo is performed or the remote_user is sudo'ing to
          themselves, we don't have to change permissions.
        * If the remote_user sudo's to a privileged user (for instance, root),
          we don't have to change permissions
        * If the remote_user sudo's to an unprivileged user then we attempt to
          grant the unprivileged user access via file system acls.
        * If granting file system acls fails we try to change the owner of the
          file with chown which only works in case the remote_user is
          privileged or the remote systems allows chown calls by unprivileged
          users (e.g. HP-UX)
        * If the chown fails, we check if ansible_common_remote_group is set.
          If it is, we attempt to chgrp the file to its value. This is useful
          if the remote_user has a group in common with the become_user. As the
          remote_user, we can chgrp the file to that group and allow the
          become_user to read it.
        * If (the chown fails AND ansible_common_remote_group is not set) OR
          (ansible_common_remote_group is set AND the chgrp (or following chmod)
          returned non-zero), we can set the file to be world readable so that
          the second unprivileged user can read the file.
          Since this could allow other users to get access to private
          information we only do this if ansible is configured with