Traceback of Poisoning Attacks to Retrieval-Augmented Generation