didTransferShares function has no access control modifier
The staked tokens (shares) in Forta are meant to be transferable. Similarly, the rewards allocation for these shares for delegated staking is meant to be transferable as well. This allocation for the shares' owner is tracked in the `StakeAllocator`. To enable this, the Forta staking contract `FortaStaking` implements a `_beforeTokenTransfer()` function that calls `_allocator.didTransferShares()` when it is appropriate to transfer the underlying allocation.\\n```\\nfunction \\_beforeTokenTransfer(\\n    address operator,\\n    address from,\\n    address to,\\n    uint256[] memory ids,\\n    uint256[] memory amounts,\\n    bytes memory data\\n) internal virtual override {\\n    for (uint256 i = 0; i < ids.length; i++) {\\n        if (FortaStakingUtils.isActive(ids[i])) {\\n            uint8 subjectType = FortaStakingUtils.subjectTypeOfShares(ids[i]);\\n            if (subjectType == DELEGATOR\\_NODE\\_RUNNER\\_SUBJECT && to != address(0) && from != address(0)) {\\n                \\_allocator.didTransferShares(ids[i], subjectType, from, to, amounts[i]);\\n            }\\n```\\n\\nDue to this, the `StakeAllocator.didTransferShares()` has an `external` visibility so it can be called from the `FortaStaking` contract to perform transfers. However, there is no access control modifier to allow only the staking contract to call this. Therefore, anyone can call this function with whatever parameters they want.\\n```\\nfunction didTransferShares(\\n    uint256 sharesId,\\n    uint8 subjectType,\\n    address from,\\n    address to,\\n    uint256 sharesAmount\\n) external {\\n    \\_rewardsDistributor.didTransferShares(sharesId, subjectType, from, to, sharesAmount);\\n}\\n```\\n\\nSince the allocation isn't represented as a token standard and is tracked directly in the `StakeAllocator` and `RewardsDistributor`, it lacks many standard checks that would prevent abuse of the function. For example, this function does not have a check for allowance or `msg.sender==from`, so any user could call `didTransferShares()` with `to` being their address and `from` being any address they want `to` transfer allocation `from`, and the call would succeed.
Apply access control modifiers as appropriate for this contract, for example `onlyRole()`.
```\\nfunction \\_beforeTokenTransfer(\\n    address operator,\\n    address from,\\n    address to,\\n    uint256[] memory ids,\\n    uint256[] memory amounts,\\n    bytes memory data\\n) internal virtual override {\\n    for (uint256 i = 0; i < ids.length; i++) {\\n        if (FortaStakingUtils.isActive(ids[i])) {\\n            uint8 subjectType = FortaStakingUtils.subjectTypeOfShares(ids[i]);\\n            if (subjectType == DELEGATOR\\_NODE\\_RUNNER\\_SUBJECT && to != address(0) && from != address(0)) {\\n                \\_allocator.didTransferShares(ids[i], subjectType, from, to, amounts[i]);\\n            }\\n```\\n