A One-Layer Decoder-Only Transformer is a Two-Layer RNN: With an Application to Certified Robustness