added support for attacking an ensemble of models with loss averaging

[tsalmonking]

Initial support for evasion attacks Model ensembles

This pull request changes the inner loop of the evasion attack to support ensembles by passing a list of models. The attack computes gradients on the average of losses of each model.

---

📚 Documentation preview 📚: https://secml-torch--116.org.readthedocs.build/en/116/

[battistabiggio]

I think it'd be better to create a separate class for this, maybe inherited from the base class. It's not common practice to optimize an attack over multiple models, so we should probably create a different class, rather than modifying the base one. @maurapintor what do you think?

[tsalmonking]

Handled in #183