Bump upper bound of `deepseq`

`deepseq-1.4.0.0`'s major change is in the default `rnf` method
implementation (see haskell/deepseq#1 for details). However, `Cabal` isn't affected
by that, and happily compiles against the current (yet unreleased) `deepseq-1.4.0.0`.

(approved by @dcoutts)