Spatial-frequency channels, shape bias, and adversarial robustness