Improving Clean Accuracy via a Tangent-Space Perspective on Adversarial Training