Backdooring Instruction-Tuned Large Language Models with Virtual Prompt Injection