LoBAM: LoRA-Based Backdoor Attack on Model Merging