Adversarial Training of Self-supervised Monocular Depth Estimation against Physical-World Attacks