Improper Access Control in `fizzy.do` import flow allows cross-tenant ActionText reference resolution and data disclosure

Description

The account import flow processes ActionText attachment HTML from user-uploaded ZIP content.

In app/models/account/data_transfer/action_text_rich_text_record_set.rb, import-time method convert_gids_to_sgids converts attacker-controlled gid values into persisted sgid values by resolving the target record globally:

• app/models/account/data_transfer/action_text_rich_text_record_set.rb:83
• app/models/account/data_transfer/action_text_rich_text_record_set.rb:87
• app/models/account/data_transfer/action_text_rich_text_record_set.rb:88
• app/models/account/data_transfer/action_text_rich_text_record_set.rb:89