Too permissive CORS for the builder server and the S3 bucket

Our current setup for the S3 bucket allows any domain to load content from the bucket by using the `Allowed Origins` header as `*`. This is a security issue, as people could upload things to our bucket and use them elsewhere in ways that we don't want.
In order to make this work, we need to:
- Change the `exposeHeaders` property in the [bucket creation script](https://github.com/decentraland/builder-server/blob/6491b926c885391d6649ce21e6bd52afca46414d/.ci/index.ts#L29) and in the [server](https://github.com/decentraland/builder-server/blob/6491b926c885391d6649ce21e6bd52afca46414d/src/common/ExpressApp.ts#L35) to have, for each environment, a set of well known domains that will be consuming these resources.
- A way of accessing those resources in the local environment. For the builder server requests, we can set a different URL for it and use a local proxy to avoid issues with CORS, and for the resources in the S3 bucket (in some of the cases), we could load them directly from the UI instead of going through the builder server.

Start by reading .ci/index.ts and src/common/ExpressApp.ts at the referenced CORS configuration points, then trace how local builder-server and S3 requests are made. Define the allowed domains for each environment and verify that local requests still work through the proposed URL or proxy arrangement, while production resources reject unapproved origins.

Written by the indexing model from the issue text.