How to Defend Image-Text Matching against Adversarial Attacks