Poisoning Attacks and Defenses to Federated Unlearning