AgentArmor: Enforcing Program Analysis on Agent Runtime Trace to Defend Against Prompt Injection