The correct way forward is creating a Customization > Theme component that does what you want there. A component like that can ship the third-party JS as a first-party asset, which is more secure and will be CSP compatible.
One recent example I’ve done is GitHub - discourse/discourse-orgchart · GitHub which ships 3 different JS libraries under it’s assets, and works just fine under CSP.