Improving Generalization of Universal Adversarial Perturbation via Dynamic Maximin Optimization