VLMGuard: Defending VLMs against Malicious Prompts via Unlabeled Data