Safety Mirage: How Spurious Correlations Undermine VLM Safety Fine-tuning