One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Models.