DB purchasing updates + CsssUser id security

[daniel-panhead]

Added additional information to Transactions/TransactionItems for purchase flow
- transactions.payment_method - track how customers paid for their purchase
- transactions.cleared - store whether or not payment has actually been made, for potential incomplete cash/card purchases
- transactions.tax_rate - track the tax rate at time of purchase for historical
- transaction_item.item_price - track the item price at time of purchase for historical purposes
By storing item prices and tax rate, we can reconstruct the total price without worrying about how those might change in the future.

CsssUsers primary key is changed from int to UUID - since we are exposing a GET /users endpoint, we want to make it difficult for people to guess user ids - UUIDs will make it sufficiently difficult to guess, and ideally paired with authentication via session token or something, should provide enough security for user profiles