Structure-Preserving Progressive Low-rank Image Completion for Defending Adversarial Attacks