When Do Universal Image Jailbreaks Transfer Between Vision-Language Models?