Defense against Backdoor Attack on Pre-trained Language Models via Head Pruning and Attention Normalization