Prompt Stealing Attacks Against Text-to-Image Generation Models