How Should Pre-Trained Language Models Be Fine-Tuned Towards Adversarial Robustness?