Lessons from Defending Gemini Against Indirect Prompt Injections