Hello!
If another plugin or theme is setting them, please notify them. It’s up to their plugin authors to choose the “correct” version — often, SEO plugins are “correct” in this.
TSF exerts a lot more effort than 3 lines of non-correcting code: it makes sure the URL always points to the intended page, which prevents your site from emitting “duplicated content” while also shielding it from negative SEO attacks.
I see you’ve also tried to contact the Sitemap plugin’s team. I believe outputting canonical URLs is out of scope for a sitemap plugin.
Add this snippet in your (child-)theme’s functions.php file, and the duplicated canonical URL should be removed:
// Remove the canonical URL output.
remove_action( 'wp_head', 'gglstmp_canonical_tag' );
// Remove the canonical URL input box.
remove_action( 'add_meta_boxes', 'gglstmp_add_custom_canonical_url' );
To learn more about sitemaps, please see https://tsf.fyi/kb/sitemap.