To be clear - You can add whatever code you want to wherever you want in this case, so long as you don’t distribute it. On your private machine, you can absolutely, 100%, add GPL2 licensed code to some Stan code, and run your model. You just can’t then distribute that derived binary or source code in a license-compliant way. This isn’t a ‘skirting around’ of the GPL2, it’s actually how it’s written.
In their FAQs:
" Does the GPL require that source code of modified versions be posted to the public? (#GPLRequireSourcePostedPublic)
The GPL does not require you to release your modified version, or any part of it. You are free to make modifications and use them privately, without ever releasing them. This applies to organizations (including companies), too; an organization can make a modified version and use it internally without ever releasing it outside the organization.
But if you release the modified version to the public in some way, the GPL requires you to make the modified source code available to the program’s users, under the GPL.
Thus, the GPL gives permission to release the modified program in certain ways, and not in other ways; but the decision of whether to release it is up to you."
Basically, the GPL2 and 3 both state you are free to take GPL2/3 code, modify and use them however you want; add in any other code you want. But once you distribute code modified by GPL2/3, or distribute GPL2/3 licensed code, then it must follow the standards set by GPL2/3 code, and license compatibility requirements.
TLDR: You can, for your own private use, absolutely incorporate the GPL3 hcubature into Stan — Whether you can then distribute that modification publicly whatsoever is a trickier issue.