I don't trust cloudflare. That is just a JS CDN that pulls a file, but is still gathered from an external server. In my case, when I have to use CDNs to use a JS library, I just download the file and host it locally.

You don't own the CDN, is controlled by other people, which means that of course is less private to the end user, and more insecure since you rely on the people running the CDN and the author or the library. What would happen if the library author/authors get hacked and they add malicious code to the library? (Asumming it doesn't contain a integrity attribute like the one on your example).

Is better to trust yourself, it doesn't cost you anything to download a few kB of a JS file and serve it directly from your server. The page is not going to load 2s faster if you use a JS CDN

And no one wants this to occur to their websites: https://fossa.com/blog/polyfill-supply-chain-attack-details-fixes/

Might I recommend github pages? Should be able to host all needed dependencies there too.

https://pages.github.com/

PS - jerboa android client didn't show your markup, may I also suggest using 3x backticks to make it formatted as you expected? Like so:

<link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.1/css/lightbox.min.css" integrity="sha256-tBxlolRHP9uMsEFKVk+hk//ekOlXOixLKvye5W2WR5c=" crossorigin="anonymous" />
<script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js" integrity="sha256-CSXorXvZcTkaix6Yvo6HppcZGetbYMGWSFlBw8HfCJo=" crossorigin="anonymous"></script>
<script src="https://cdnjs.cloudflare.com/ajax/libs/lightbox2/2.11.1/js/lightbox.min.js" integrity="sha256-CtKylYan+AJuoH8jrMht1+1PMhMqrKnB8K5g012WN5I=" crossorigin="anonymous"></script>

One way or another, the server that hosts a resource can track who is requesting what. You as the server owner can just as easily track who is accessing what, but if you avoid using a CDN, then it limits the tracker to just yourself. The cost is that you'll have increased traffic, and there is always the suspicion that you may have tampered with the lightbox.js file to do something malicious.

On the self include side, the instructions you linked seem pretty straightforward, so it should be possible to use it that way. What is issue your facing?

How would things break from including it yourself? Just download the file from the links in your post and include them on your webserver it shouldn't require any code changes beyond that. You also never know if they would take down an old version or if some outage will occur so I'd personally rather host them instead of relying on additional servers to work.