PuFace: Defending against Facial Cloaking Attacks for Facial Recognition Models