PRSA: PRompt Stealing Attacks against Large Language Models