Characterizing the Optimal 0-1 Loss for Multi-class Classification with a Test-time Attacker