SALSA: Attacking Lattice Cryptography with Transformers