It's loading from a 3rd party (with a 3rd-party HTTP request), but the script itself is run by the first party: scripts are owned by whichever page executes them, regardless of how that page conjured them up. That's why you can load jquery from a CDN without breaking lots of things, because jquery still "runs from" your domain, same as if it were hosted locally. Also a reason that you really need to trust the third-party host, because if you load malicious third-party JS, it runs from your domain.

We use first party cookies and do not try to track people across websites which is what most ad networks actually do.

The snippet you paste is for our purposes equivalent to:

    <script src="http://www.google-analytics.com/ga.js">

Inside the script there are calls to cookie-dropping javascript functions. The browser makes no distinction between javascript loaded via a script tag from your domain, another domain, or simply inline, so any cookies it leaves or reads are "first party".

If they set cookies via HTTP on the request for www.google-analytics.com/ga.js, those would be "third party", and because google-analytics.com isn't a site anyone visits, the new firefox policy would reject them.