SoK: Pitfalls in Evaluating Black-Box Attacks