local facts shall only be readable by root

tasks/local_facts.yaml

@@ -9,6 +9,7 @@
   copy:
     content: "{{_local_facts|to_json}}"
     dest: /etc/ansible/facts.d/{{role_name}}.fact
+    mode: 0600
   register: _local_facts_set
 
 - name: Gathering Facts