One ES module script tag without crossorigin:
<script type="module" src="https://cdn.jsdelivr.net/.../three.module.js"></script>
Expected trigger in analyzer 025_https_mixed_content:
Note: this script will also trigger W08 (SRI missing) since it has no integrity hash.