On Evaluating Adversarial Robustness of Chest X-ray Classification: Pitfalls and Best Practices