CertMask: Certifiable Defense Against Adversarial Patches via Theoretically Optimal Mask Coverage