The Adversarial Consistency of Surrogate Risks for Binary Classification