<!--- Verify first that your issue is not already reported on GitHub -->
<!--- Also test if the latest release and devel branch are affected too -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY
<!--- Explain the problem briefly below -->
In Ansible 2.7, I was able to specify an alternative executable at the task level when running the raw module.  This behaviour has changed in 2.9; the task no longer honors executable.

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
<!--- Write the short name of the module, plugin, task or feature below, use your best guess if unsure -->
raw

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes -->
```paste below
ansible 2.9.4
  config file = /home/rowagn/data-platform/ansible_bootstrap/ansible.cfg
  configured module search path = [u'/home/rowagn/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /sso/sfw/virtualenv/ansible29/lib/python2.7/site-packages/ansible-2.9.4-py2.7.egg/ansible
  executable location = /sso/sfw/virtualenv/ansible29/bin/ansible
  python version = 2.7.17 (default, Feb  6 2020, 10:54:17) [GCC 5.4.0 20160609]

```

##### CONFIGURATION
<!--- Paste verbatim output from "ansible-config dump --only-changed" between quotes -->
```paste below
ALLOW_WORLD_READABLE_TMPFILES(/home/rowagn/data-platform/ansible_bootstrap/ansible.cfg) = True
ANSIBLE_PIPELINING(/home/rowagn/data-platform/ansible_bootstrap/ansible.cfg) = True
ANSIBLE_SSH_ARGS(/home/rowagn/data-platform/ansible_bootstrap/ansible.cfg) = -C -o ControlMaster=no -o StrictHostKey
DEFAULT_EXECUTABLE(/home/rowagn/data-platform/ansible_bootstrap/ansible.cfg) = /bin/sh
DEFAULT_HOST_LIST(/home/rowagn/data-platform/ansible_bootstrap/ansible.cfg) = [u'/home/rowagn/data-platform/ansible_
RETRY_FILES_ENABLED(/home/rowagn/data-platform/ansible_bootstrap/ansible.cfg) = False

```

##### OS / ENVIRONMENT
<!--- Provide all relevant information below, e.g. target OS versions, network device firmware, etc. -->
I'll elaborate below, but our users are not allowed to execute /bin/sh (or other shells) as sudo.

##### STEPS TO REPRODUCE
<!--- Describe exactly how to reproduce the problem, using a minimal test-case -->
create a user (i.e., testuser) on the target machine with the following restrictions in /etc/sudoers:
```
Cmnd_Alias      SHELLS = /bin/sh
testuser  ALL=(ALL)  ALL, !SHELLS
```
create /etc/ansible-wrapper on the target machine with 755 permissions containing:
```
#!/bin/bash
[[ -z $1 ]] && exit 0
/bin/bash -c "$@"
```
create ansible.cfg containing:
```
executable=/bin/sh
```
Then run the playbook in 2.7 and 2.9 environments.
```
ansible-playbook a.yml -K -k -utestuser
```
<!--- Paste example playbooks or commands between quotes below -->
```yaml
$ cat a.yml 
---
- hosts: all
  gather_facts: no
  tasks:
  - name: whoami
    raw: echo "test" > /tmp/test 
    args:
      executable: "/etc/ansible-wrapper"
    become: yes
    become_method: sudo
```

<!--- HINT: You can paste gist.github.com links for larger files -->

##### EXPECTED RESULTS
<!--- Describe what you expected to happen when running the steps above -->
Expected (this is what happens on ansible 2.7):
```
$ ansible-playbook a.yml -K -k -utestuser -vvv
ansible-playbook 2.7.0
  config file = /home/rowagn/data-platform/ansible_bootstrap/ansible.cfg
  configured module search path = [u'/home/rowagn/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /sso/sfw/python2/lib/python2.7/site-packages/ansible-2.7.0-py2.7.egg/ansible
  executable location = /sso/sfw/python2/bin/ansible-playbook
  python version = 2.7.12 (default, Apr 25 2017, 09:26:15) [GCC 5.4.0 20160609]
Using /home/rowagn/data-platform/ansible_bootstrap/ansible.cfg as config file
SSH password: 
SUDO password[defaults to SSH password]: 
Parsed /home/rowagn/data-platform/ansible_bootstrap/hosts inventory source with ini plugin

PLAYBOOK: a.yml ******************************************************************************************************
1 plays in a.yml

PLAY [all] ***********************************************************************************************************
META: ran handlers

TASK [whoami] ********************************************************************************************************
task path: /home/rowagn/data-platform/ansible_bootstrap/a.yml:5
<rowagn-tower-test01.vsp.sas.com> ESTABLISH SSH CONNECTION FOR USER: testuser
<rowagn-tower-test01.vsp.sas.com> SSH: EXEC sshpass -d9 ssh -C -o ControlMaster=no -o StrictHostKeyChecking=no -o User=testuser -o ConnectTimeout=10 -tt rowagn-tower-test01.vsp.sas.com '/etc/ansible-wrapper -c '"'"'sudo -H -S  -p "[sudo via ansible, key=ftbmhhvbpkovfeymzyhwqpmtjrwljdkp] password: " -u root /etc/ansible-wrapper -c '"'"'"'"'"'"'"'"'echo BECOME-SUCCESS-ftbmhhvbpkovfeymzyhwqpmtjrwljdkp; echo "test" > /tmp/test'"'"'"'"'"'"'"'"''"'"''
Escalation succeeded
<rowagn-tower-test01.vsp.sas.com> (0, '\r\n', 'Connection to rowagn-tower-test01.vsp.sas.com closed.\r\n')
changed: [rowagn-tower-test01.vsp.sas.com] => {
    "changed": true, 
    "rc": 0, 
    "stderr": "Connection to rowagn-tower-test01.vsp.sas.com closed.\r\n", 
    "stderr_lines": [
        "Connection to rowagn-tower-test01.vsp.sas.com closed."
    ], 
    "stdout": "\r\n", 
    "stdout_lines": [
        ""
    ]
}
META: ran handlers
META: ran handlers

PLAY RECAP ***********************************************************************************************************
rowagn-tower-test01.vsp.sas.com : ok=1    changed=1    unreachable=0    failed=0   

```
If I tail /var/log/secure on the target, I see the following is executed:
```
Mar  5 19:38:06 rowagn-tower-test01 sudo: testuser : TTY=pts/1 ; PWD=/home/testuser ; USER=root ; COMMAND=/etc/ansible-wrapper -c echo BECOME-SUCCESS-blsgdxudsexamxfpsscdlgkglhynitnw; echo "test" > /tmp/test
```

##### ACTUAL RESULTS
<!--- Describe what actually happened. If possible run with extra verbosity (-vvvv) -->
Actual (this is what happens on Ansible 2.9):
<!--- Paste verbatim command output between quotes -->
```
$ ansible-playbook a.yml -K -k -utestuser -vvv
ansible-playbook 2.9.4
  config file = /home/rowagn/data-platform/ansible_bootstrap/ansible.cfg
  configured module search path = [u'/home/rowagn/.ansible/plugins/modules', u'/usr/share/ansible/plugins/modules']
  ansible python module location = /sso/sfw/virtualenv/ansible29/lib/python2.7/site-packages/ansible-2.9.4-py2.7.egg/ansible
  executable location = /sso/sfw/virtualenv/ansible29/bin/ansible-playbook
  python version = 2.7.17 (default, Feb  6 2020, 10:54:17) [GCC 5.4.0 20160609]
Using /home/rowagn/data-platform/ansible_bootstrap/ansible.cfg as config file
SSH password: 
BECOME password[defaults to SSH password]: 
host_list declined parsing /home/rowagn/data-platform/ansible_bootstrap/hosts as it did not pass its verify_file() method
script declined parsing /home/rowagn/data-platform/ansible_bootstrap/hosts as it did not pass its verify_file() method
auto declined parsing /home/rowagn/data-platform/ansible_bootstrap/hosts as it did not pass its verify_file() method
Parsed /home/rowagn/data-platform/ansible_bootstrap/hosts inventory source with ini plugin

PLAYBOOK: a.yml ****************************************************************************************************
1 plays in a.yml

PLAY [all] *********************************************************************************************************
META: ran handlers

TASK [whoami] ******************************************************************************************************
task path: /home/rowagn/data-platform/ansible_bootstrap/a.yml:5
<rowagn-tower-test01.vsp.sas.com> ESTABLISH SSH CONNECTION FOR USER: testuser
<rowagn-tower-test01.vsp.sas.com> SSH: EXEC sshpass -d8 ssh -C -o ControlMaster=no -o StrictHostKeyChecking=no -o 'User="testuser"' -o ConnectTimeout=10 -tt rowagn-tower-test01.vsp.sas.com '/etc/ansible-wrapper -c '"'"'sudo -H -S  -p "[sudo via ansible, key=iayqkqennnjnowmcjazgysiwuozpbzmy] password:" -u root /bin/sh -c '"'"'"'"'"'"'"'"'echo BECOME-SUCCESS-iayqkqennnjnowmcjazgysiwuozpbzmy ; echo "test" > /tmp/test'"'"'"'"'"'"'"'"''"'"''
Escalation succeeded
<rowagn-tower-test01.vsp.sas.com> (1, '\r\n', 'Connection to rowagn-tower-test01.vsp.sas.com closed.\r\n')
<rowagn-tower-test01.vsp.sas.com> Failed to connect to the host via ssh: Connection to rowagn-tower-test01.vsp.sas.com closed.
fatal: [rowagn-tower-test01.vsp.sas.com]: FAILED! => {
    "changed": true, 
    "msg": "non-zero return code", 
    "rc": 1, 
    "stderr": "Connection to rowagn-tower-test01.vsp.sas.com closed.\r\n", 
    "stderr_lines": [
        "Connection to rowagn-tower-test01.vsp.sas.com closed."
    ], 
    "stdout": "\r\n", 
    "stdout_lines": [
        ""
    ]
}

PLAY RECAP *********************************************************************************************************
rowagn-tower-test01.vsp.sas.com : ok=0    changed=0    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0   
```
If I tail /var/log/secure on the target, I see the following is executed:
```
Mar  5 19:38:32 rowagn-tower-test01 sudo: testuser : command not allowed ; TTY=pts/1 ; PWD=/home/testuser ; USER=root ; COMMAND=/bin/sh -c echo BECOME-SUCCESS-gurlxipwqzptgdiqwmrmaevflvziiiff ; echo "test" > /tmp/test
```

So in the 2.7 case, /etc/ansible-wrapper was used as the executable, as specified in the playbook, but in the 2.9 case, /bin/sh (from ansible.cfg) is used.

Here's why this is a problem for us.  Our IT crew doesn't allow us to execute shells (/bin/sh, /bin/bash, etc) with sudo.  As a workaround, we create the above wrapper script on all our target hosts and use executable=/etc/ansible-wrapper in our ansible.cfg files.  This all works fine.  However, we have a playbook that we use to bootstrap our target hosts.  The bootstrap playbook uses executable=/bin/sh (in ansible.cfg).  It copies /etc/ansible-wrapper out to the target in the user's home directory (which uses /bin/sh, since no sudo is needed).  Then, it uses the raw module to move ansible-wrapper to /etc, but since this requires sudo, it specifies /home/user/ansible-wrapper as the executable for that task (similarly to the above playbook).  Without being able to specify executable, this playbook breaks in Ansible 2.9.

if res['rc'] != 0:
                        raise AnsibleError('Failed to set file mode on remote temporary files (rc: {0}, err: {1})'.format(res['rc'], to_native(res['stderr'])))
                res = self._remote_chown(remote_paths, self.get_become_option('become_user'))
                if res['rc'] != 0 and remote_user in self._get_admin_users():
                    
                    raise AnsibleError('Failed to change ownership of the temporary files Ansible needs to create despite connecting as a privileged user. '
                                       'Unprivileged become user would be unable to read the file.')
                elif res['rc'] != 0:
                    if C.ALLOW_WORLD_READABLE_TMPFILES:
                        
                        
                        display.warning('Using world-readable permissions for temporary files Ansible needs to create when becoming an unprivileged user. '
                                        'This may be insecure. For information on securing this, see '
                                        'https://docs.ansible.com/ansible/user_guide/become.html#risks-of-becoming-an-unprivileged-user')
                        res = self._remote_chmod(remote_paths, 'a+%s' % chmod_mode)
                        if res['rc'] != 0:
                            raise AnsibleError('Failed to set file mode on remote files (rc: {0}, err: {1})'.format(res['rc'], to_native(res['stderr'])))
                    else:
                        raise AnsibleError('Failed to set permissions on the temporary files Ansible needs to create when becoming an unprivileged user '
                                           '(rc: %s, err: %s}). For information on working around this, see '
                                           'https://docs.ansible.com/ansible/become.html#becoming-an-unprivileged-user'
                                           % (res['rc'], to_native(res['stderr'])))
        elif execute:
            
            
            res = self._remote_chmod(remote_paths, 'u+x')
            if res['rc'] != 0:
                raise AnsibleError('Failed to set execute bit on remote files (rc: {0}, err: {1})'.format(res['rc'], to_native(res['stderr'])))
        return remote_paths
    def _remote_chmod(self, paths, mode, sudoable=False):