Defending Against Indirect Prompt Injection Attacks With Spotlighting