Only grant trusted users the permission to purge entities

If I'm to believe the purge form:

Purging "{{entity}}" from the database should only be done as a last resort when sensitive information has been introduced inadvertently into a database. In clustered or replicated environments it is very difficult to guarantee that a particular purged document has been removed from all replicas.

So this should be an action that only trusted users who know what they're doing (especially in clustered/replicated envs) should be allowed to perform.