If I drive an LED whose forward voltage is 2V with a source that’s 3.3V limited to 20ma, will I harm the LED

Actually the linked HC4017 data sheet explains how to expand the counter. Look at page 15. But you only get 17 stages out of 2 counters, and additional 8 stages for each additional one.

There are a number of options, most of them discussed in this post. Since the communication is one way you can use:

• Voltage dividers: cheap and easey: 2 resistors. Cannot provide stiff voltage sources unless you lose a lot of power through them
• A diode with a resistor circuit. Same as previous
• Level shifter (something like a 74LVC245)

There are shift registers that do run on 3.3V: depending on how many lines you need, an easier solution might be to shift the Arduino output to 3.3V, and feed that to a 3.3V shift register. This will likely (again, depending on your setup) in fewer lines to be level-shifted.

EDIT: Yes, you will need current-limiting resistors for your LEDs, however, voltage divider != a single resistor. Voltage divider looks like this:

^{simulate this circuit – Schematic created using CircuitLab}

EDIT2: Usually not. You should read the datasheet for the shift register you are planning to use about its various maximum voltages. P.S. When you say "serial pins" you don't mean the Serial TX and Serial RX, right? Usually, one drives shift registers using general purpuse digital IO pins. You can use serial pins for two of those, but usually you need a more pins to drive a shift register (usually at least three in the case of 74HC595). The point is 74HC595 is driven via SPI protocol, not RS-232