Using CanadaPost AddressComplete library that has the following snipet:

    /* Preload images that are to be used in the css. */
    function preloadImage(url) {
        var img = new Image();
        img.src = url;
    }

    preloadImage('//' + pca.host + '/images/icons/captureplus/loqatelogoinverted.svg');
    preloadImage('//' + pca.host + '/images/icons/captureplus/geolocationicon.svg');
    preloadImage('//' + pca.host + '/images/icons/captureplus/loader.gif');
    preloadImage('//' + pca.host + '/images/icons/captureplus/chevron.png');

Although I get the script via https, both Firefox 128 and Chrome 126 is trying to get them via http, violating our site’s CSP.

Can I change the browser’s behavior via javascript in my own JS code or in the script tag that fetches the library? I do not have edit rights on the JS library that contains the above snipet. Or must I add http to CSP for img-src?