Benchmarking Poisoning Attacks against Retrieval-Augmented Generation