CORS preflight OPTIONS request fails with 403

### Before opening, please confirm:

- [X] I have checked to see if my question is addressed in the [FAQ](https://github.com/aws-amplify/amplify-hosting/blob/master/FAQ.md).
- [X] I have [searched for duplicate or closed issues](https://github.com/aws-amplify/amplify-hosting/issues?q=is%3Aissue+).
- [X] I have read the guide for [submitting bug reports](https://github.com/aws-amplify/amplify-hosting/blob/master/CONTRIBUTING.md).
- [X] I have done my best to include a minimal, self-contained set of instructions for consistently reproducing the issue.
- [X] I have removed any sensitive information from my code snippets and submission.

### App Id

d1twcvjf92buo6

### AWS Region

eu-central-1

### Amplify Hosting feature

Access control, Custom headers

### Describe the bug

OPTIONS preflight request fails with 403 forbidden even if access control is set to "publicly viewable":
```

AccessForbidden
CORSResponse: CORS is not enabled for this bucket.
GET
BUCKET
----------
----------

```

For this reason, there is a CORS error when the app is called from another domain:
> Access to fetch at 'https://abc.....' from origin 'https://def.....' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource. If an opaque response serves your needs, set the request's mode to 'no-cors' to fetch the resource with CORS disabled.

No backend environment is configured for this application, only hosting.

### Expected behavior

OPTIONS preflight request is successful / returns 200

### Reproduction steps

Use CURL or Postman to send preflight OPTIONS request to your APP URL

### Build Settings

_No response_

### Log output

```
# Put your logs below this line

```

### Additional information

_No response_

Start by reproducing the preflight OPTIONS request against the application URL with cURL or Postman in eu-central-1, using the reported cross-origin setup. Done means the request succeeds with HTTP 200 and the expected CORS response headers, without the reported 403 or CORS-disabled bucket message.

Written by the indexing model from the issue text.