Certifying Geometric Robustness of Neural Networks