Joint photon-number splitting attack on semi-quantum key distribution