Exposing Fine-Grained Adversarial Vulnerability of Face Anti-Spoofing Models