Not All Prompts Are Secure: A Switchable Backdoor Attack Against Pre-trained Vision Transformers