##### SUMMARY
Support become unprivileged user on macOS without `allow_world_readable_tmpfiles=true`

##### ISSUE TYPE
- Feature Idea

##### COMPONENT NAME
action, shell, and copy

##### ADDITIONAL INFORMATION
When using become where the login user and the become user are both unprivileged, Ansible attempts to securely change file permissions to only allow the become user to read the files. It uses `setfacl` and falls back to `chown`. Both of these fail on macOS, as there is no `setfacl` command and `chown` is not permitted.

macOS actually does provide the same functionality as `setfacl`, using `chmod +a`. The syntax is a bit different from `setfacl`, but it should be able to do what Ansible needs.
'''
        Determines if we are required and can do pipelining
        '''
        try:
            is_enabled = self._connection.get_option('pipelining')
        except (KeyError, AttributeError, ValueError):
            is_enabled = self._play_context.pipelining
        
        
        always_pipeline = self._connection.always_pipeline_modules
        
        
        become_exception = (self._connection.become.name if self._connection.become else '') != 'su'
        
        conditions = [
            self._connection.has_pipelining,    
            is_enabled or always_pipeline,      
            module_style == "new",              
            not C.DEFAULT_KEEP_REMOTE_FILES,    
            not wrap_async or always_pipeline,  
            become_exception,
        ]
        return all(conditions)
    def _get_admin_users(self):
        '''
        Returns a list of admin users that are configured for the current shell
        plugin
        '''
        return self.get_shell_option('admin_users', ['root'])
    def _get_remote_user(self):