You are completely correct that loading just one script over HTTP means walkover to a MITM. So what can you do?
If the script is served over HTTPS
As Ajedi32 suggests in comments: If the script is served over HTTPS, you can force the widget to use HTTPS by using the CSP upgrade-insecure-requests
directive.
If you have control over the script tag
If the script isn't served over HTTPS at all, things will be a bit more complicated. You don't have to allow all scripts to be loaded over HTTPS, you can just allow that one. Still, for a MITM that would be enough.
If you have control over the script tag where the script is included, you can use subresource integrity to stop a MITM. You provide a hash of the script in the integrity
attribute of the script tag. The browser verifies the hash, thereby stopping any attempts by a MITM to modify the script. It will also give you a headache if the maintainers of the script changes the content without notifying you first...
Else
You are out of luck. Contact whoever constructed the widget and tell them to use HTTPS. Or just dump the widget.