Comment 5 for bug 1543572

My workaround to install the http2 module and still be get security-updates:

Since the http2 module is still included in the source it's pretty easy to compile it and copy it back to the apache installed from the package.

Make sure you've the source repositories in the apt sources.

You need to install libnghttp2-dev, download the apache2 sources and build them without any changes:
$ sudo apt-get install libnghttp2-dev
$ mkdir apache2
$ cd apache2
$ apt-get source apache2
$ sudo apt-get build-dep apache2
$ cd apache-2.4.18
$ fakeroot debian/rules binary

afterwards just copy the http2.so from debian/apache2-bin/usr/lib/apache2/modules/mod_http2.so to /usr/lib/apache2/modules/ and create a load-file in $APACHE-ROOT/mods-available/

HTH