Adversarial Robustness Guarantees for Classification with Gaussian Processes