Black-box Backdoor Defense via Zero-shot Image Purification