Assign object categories to purchaes

The vast majority of Device42 objects have the ability to assign object categories to them to manage permissions. For purchases, this isn't possible because there is no object category field on them. 

Purchases can contain commercially sensitive information and it should be possible to use RBAC to manage permissions on them.