I don't think mixed content refers to CORS at all. It's saying that you're loading an insecure resource (http://...) from a secure page (https://...). That makes sense actually. Itch serves everything from https so you'll need to load your analytics script from a secure server as well.
(The reason for the error, I imagine, is that otherwise the user is misled about the level of security on the page. It appears to be secure, but in fact it could be attacked by tampering with the insecure script.)