Creating an S3 Bucket with "BucketOwnerEnforced" is not done atomically, causing a failure if BucketOwnerEnforced is enforced by an SCP

### Name of the resource

AWS::S3::Bucket

### Resource name

_No response_

### Description

S3 recently introduced the BucketOwnerEnforced feature which enables creation of an S3 bucket with a flag that ensures all objects are owned by the bucket owner. Through AWS Organization's service control policies, customers now will want to prevent creation of any bucket that does NOT have BucketOwnerEnforced enabled. If a customer enables this SCP for their AWS account, this effectively disables bucket creation completely, even if one is explicitly creating a bucket with this flag. The reason for this is that CloudFormation applies the BucketOwnerEnforced option AFTER an S3 bucket is created, through the PutBucketOwnershipControls API.

My request is that the CloudFormation team applies the BucketOwnerEnforced option at bucket creation, and not after the fact. Otherwise, customers cannot create buckets if this feature is enabled.

### Other Details

Here is an example SCP that forces BucketOwnerEnforced to be applied at bucket creation time:

```
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "DenyCreateModifyBucketWithACLs",
"Effect": "Deny",
"Action": [
"s3:CreateBucket",
"s3:PutBucketOwnershipControls"
],
"Resource": "*",
"Condition": {
"StringNotEquals": {
"s3:x-amz-object-ownership": [
"BucketOwnerEnforced"
]
}
}
}
]
}
```

If the above SCP is applied to an account through AWS Organizations, it effectively disables bucket creation even if one specifies the option in CloudFormation:

```
AWSTemplateFormatVersion: "2010-09-09"
Resources:
RandomBucketName:
Type: AWS::S3::Bucket
Properties:
OwnershipControls:
Rules:
- ObjectOwnership: BucketOwnerEnforced
```

Start with the AWS::S3::Bucket example and the documented OwnershipControls behavior, then reproduce the failure using the supplied SCP. Done means CloudFormation creates the bucket with BucketOwnerEnforced in the creation request so the SCP permits creation without a later ownership-controls call.

Written by the indexing model from the issue text.