Add "common corruption" transformations as a warmup attack

[nottombrown]

I think that the transformations from Benchmarking Neural Network Robustness to Common Corruptions and Surface Variations by Dan Hendrycks and Tom Dietterich would be a good addition to the warmup attacks.

Three reasons why I think that this would be a good addition:

1. Their corruptions clearly illustrate a set of non-lp-restricted attacks
2. These corruptions are strictly easier than an unrestricted adversary
3. They have a simple and well-designed codebase

Tasks

• [x] Check their license (👍 Apache is good)
• [x] Convert their library into a pip module (either in place or copy it into this repository)
• [x] Add all transformations at severity 1 as a warmup attack on the bird-or-bicycle dataset (Perhaps 10 transformations per image)
• [x] Evaluate baseline defenses
• [x] Inspect confident misclassifications to ensure that they are unambiguous to a human

[nottombrown]

I think that this would be most relevant for the bird-or-bicycle dataset (because that's what the original authors designed it for), and need not be added to MNIST.

[nottombrown]

@hendrycks has volunteered to be the author of this after the ICLR crunch https://github.com/hendrycks/robustness/issues/2#issuecomment-423273663 Thanks!

[nottombrown]

Added in #51