After working on CORS for the new S3 provider, we realised that S3 would allow all origins by default if CORS was configured for the bucket. This fix cleans up all CORS headers returned by moto, then checks if CORS is configured for the bucket.
(Before, the headers would be cleaned up only if the bucket had CORS configured).
The new logic is:

1. After the response is returned from moto, clean up all CORS related headers
2. If CORS is configured for the bucket, append the specific matched CORS rule headers.
3. If CORS is not configured, append the default CORS headers of LocalStack (which you can extend with config variables).

We worked on this fix in tandem with @dfangl

This might create some issues with customers accessing S3 from websites. The quickest fix to this issue is to add the needed origins to EXTRA_CORS_ALLOWED_ORIGINS, or to configure CORS for the S3 bucket.