##### SUMMARY
Support become unprivileged user on macOS without `allow_world_readable_tmpfiles=true`

##### ISSUE TYPE
- Feature Idea

##### COMPONENT NAME
action, shell, and copy

##### ADDITIONAL INFORMATION
When using become where the login user and the become user are both unprivileged, Ansible attempts to securely change file permissions to only allow the become user to read the files. It uses `setfacl` and falls back to `chown`. Both of these fail on macOS, as there is no `setfacl` command and `chown` is not permitted.

macOS actually does provide the same functionality as `setfacl`, using `chmod +a`. The syntax is a bit different from `setfacl`, but it should be able to do what Ansible needs.
action_base._execute_module.return_value = dict(stat=dict(exists=True))
        res = action_base._execute_remote_stat(path='/path/to/file', all_vars=dict(), follow=False)
        self.assertTrue(res['exists'])
        self.assertEqual(res['checksum'], '')
        # test st
        action_base._execute_module.return_value = dict(failed=True, msg="because I said so")
        self.assertRaises(AnsibleError, action_base._execute_remote_stat, path='/path/to/file', all_vars=dict(), follow=False)
    def test_action_base__execute_module(self):
        
        mock_task = MagicMock()
        mock_task.action = 'copy'
        mock_task.args = dict(a=1, b=2, c=3)
        
        def build_module_command(env_string, shebang, cmd, arg_path=None):
            to_run = [env_string, cmd]
            if arg_path:
                to_run.append(arg_path)
            return " ".join(to_run)
        def get_option(option):
            return {'admin_users': ['root', 'toor']}.get(option)
        mock_connection = MagicMock()
        mock_connection.build_module_command.side_effect = build_module_command
        mock_connection.socket_path = None
        mock_connection._shell.get_remote_filename.return_value = 'copy.py'
        mock_connection._shell.join_path.side_effect = os.path.join
        mock_connection._shell.tmpdir = '/var/tmp/mytempdir'
        mock_connection._shell.get_option = get_option
        
        play_context = PlayContext()