ALMGuard: Safety Shortcuts and Where to Find Them as Guardrails for Audio-Language Models