On Collective Robustness of Bagging Against Data Poisoning