On Pruning Adversarially Robust Neural Networks