On the Certified Robustness for Ensemble Models and Beyond