Fewer is More: Trojan Attacks on Parameter-Efficient Fine-Tuning