Regarding the behavior you’re observing is Discourse downloading a local copy of the images. The site setting you’re looking for is download remote images to local.
Searching download in admin settings will populate some more related settings as well.
As for the original issue, it looks like it is due to the fact that insecure http requests are blocked. Once the image is downloaded and served over the same (https) domain, it works.