Add a way to limit deserialized string lengths

and use it for most strings being serialized.
Merge pull request #4655

216e9a4 Add a way to limit deserialized string lengths (Pieter Wuille)