@Samwilson

Loading failed for the <script> with source “https://www.openlayers.org/api/OpenLayers.js”.

I am not sure why you should be getting that (one of the reasons may be that “https://www.openlayers.org/api/OpenLayers.js ” actually redirects to "http://openlayers.org/api/OpenLayers.js " ).

Change the link to "https://openlayers.org/api/OpenLayers.js " instead of "https://www.openlayers.org/api/OpenLayers.js". It should work.

The problem with the non-HTTPS one is that I then get the Blocked loading mixed active content “http://openlayers.org/api/OpenLayers.js” error.

you need to change the link to "https://openlayers.org/api/OpenLayers.js "(openlayers must be without www, otherwise it will again redirect to “http://openlayers.org/api/OpenLayers.js ” )

Gosh, thank you, I feel quite inobservant! :-) I've fixed it up, and that error is now gone.

Unfortunately, other assets are being loaded via HTTP now:

Loading mixed (insecure) display content “http://c.tile.openstreetmap.org/17/107698/77830.png” on a secure page

Which I guess can be fixed in ext.cargo.maps?

I'd submit a patch, but I'm not sure if openlayers should be bundled, or there should be an option of using the CDN, or what.

I don't think it can be fixed in ext.cargo.maps because these links are called by OpenLayers.js.
I found a discussion related to this, it may be somewhat helpful: https://gis.stackexchange.com/questions/83953/openlayers-maps-issue-with-ssl

Change 423588 had a related patch set uploaded (by Samwilson; owner: Samwilson):
[mediawiki/extensions/Cargo@master] Use protocol-relative URLs for OpenLayers and OSM

https://gerrit.wikimedia.org/r/423588

Change 423588 merged by jenkins-bot:
[mediawiki/extensions/Cargo@master] Use protocol-relative URLs for OpenLayers and OSM

https://gerrit.wikimedia.org/r/423588