$B^4$: A Black-Box Scrubbing Attack on LLM Watermarks