Why I can’t add a script-code into theme-settings without 403-forbidden?

Solution:

Because the theme JavaScript is not in:

/js/sticky-menu.js

Rather, it’s in your theme folder (as your theme name is lifestyle-pro, as found from your site’s HTML):

/wp-content/themes/lifestyle-pro/js/sticky-menu.js

So your <script> CODE should be:

<script data-cfasync="false" src="https://wordpress.stackexchange.com/wp-content/themes/lifestyle-pro/js/sticky-menu.js"></script>

Bonus:

This can be made better with the use of the WordPress function get_stylesheet_directory_uri(). In that case, your CODE will be:

<script data-cfasync="false" src="https://wordpress.stackexchange.com/questions/255193/<?php echo get_stylesheet_directory_uri(); ?>/js/sticky-menu.js"></script>

An even better method is to use wp_enqueue_script() function in combination with wp_enqueue_scripts filter hook, as described in this WordPress document.