Make 'attestations' field required when purchasing privileges

[landonshumway-ia]

In an effort to keep the application able to be demo'd at all times, we previously implemented a feature to the privilege purchasing endpoint to validate a list of attestations, but left the 'attestations' field in the post body as optional. This ticket includes ensuring all the known attestations are in the DB (i.e. military attestations, jurisprudence-confirmation, etc.) as well as enforcing that the 'attestation' field is present with all of the required attestations when calling the privilege purchase endpoint.

[landonshumway-ia]

This ticket can be completed after #335