##### SUMMARY
Support become unprivileged user on macOS without `allow_world_readable_tmpfiles=true`

##### ISSUE TYPE
- Feature Idea

##### COMPONENT NAME
action, shell, and copy

##### ADDITIONAL INFORMATION
When using become where the login user and the become user are both unprivileged, Ansible attempts to securely change file permissions to only allow the become user to read the files. It uses `setfacl` and falls back to `chown`. Both of these fail on macOS, as there is no `setfacl` command and `chown` is not permitted.

macOS actually does provide the same functionality as `setfacl`, using `chmod +a`. The syntax is a bit different from `setfacl`, but it should be able to do what Ansible needs.
'''
    This class is the base class for all action plugins, and defines
    code common to all actions. The base class handles the connection
    by putting/getting files and executing commands based on the current
    action in use.
    '''
    
    _VALID_ARGS = frozenset([])
    def __init__(self, task, connection, play_context, loader, templar, shared_loader_obj):
        self._task = task
        self._connection = connection
        self._play_context = play_context
        self._loader = loader
        self._templar = templar
        self._shared_loader_obj = shared_loader_obj
        self._cleanup_remote_tmp = False
        self._supports_check_mode = True
        self._supports_async = False
        
        self._discovered_interpreter_key = None
        self._discovered_interpreter = False
        self._discovery_deprecation_warnings = []
        self._discovery_warnings = []
        
        self._display = display
        self._used_interpreter = None
    @abstractmethod
    def run(self, tmp=None, task_vars=None):