I’m not able to find any recent update that would have stopped avatars to work via the api when all the site settings have them blocked. Regardless, if you are using SSO (or DiscourseConnect), you should be using the /admin/users/sync_sso api route to update the users avatar not the UI route (/u/username/preferences/avatar/pick).
And pass in these params in the request body:
avatar_url: "url-of-image",
avatar_force_update: "true"