Limit size of `DeserializerCache`, auto-flush on exceeding

[cowtowncoder]

(note: offshoot of #1905)

Currently size of deserializer cache is not bounded: this is something that goes against the cardinal rule of caches ("never use unbounded caches for unbounded domain").
This needs to go in 3.0 because tweaks to caching are generally high-risk changes.

[cowtowncoder]

As with serializer caching, start with max of 4000 entries; probably bigger than necessary, but most important to be bound for now.

[cowtowncoder]

Changed to 2000; backporting in 2.10.