BadCLIP: Trigger-Aware Prompt Learning for Backdoor Attacks on CLIP