How do I do that with GitHub pages? In my case (glowing-bear.org), I'd like to tell Cloudflare to accept valid certificates for glowing-bear.github.io (or * .github.io) because that's the origin certificate. But I haven't found an option to do so.

Github has no provision for this. So it's more a Github issue than a Cloudflare one. The latter has the Full (but not strict) SSL option for precisely this situation, which is arguably better than going with Flexible SSL.