After you have SSO setup, you can call the sync_sso route anytime to update a user values with the standard SSO payload, that includes the avatar.
That is documented at Official Single-Sign-On for Discourse (sso) and Sync SSO user data with the sync_sso route