Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularization