To clarify in case this was necessary or for other readers, the problem here is the presence of the following header being returned by the server:
Content-Security-Policy: img-src https: data:
This header could have been added by a Flarum extension (but I don't know any that would do that), in the apache/nginx config (but none was found above) or by some other program, configuration or proxy on the webserver as suggested by [deleted]
