Defending against Universal Adversarial Patches by Clipping Feature Norms