Ensure that CORS is set for the buckets holding static resources

It seems that after a second update is deployed to a review env, there are a lot of CSRF errors in the browser, due to the fact that the CORS settings are not properly set in the browser:

We would need the following settings:
```json
[
{
"AllowedHeaders": [
"Authorization"
],
"AllowedMethods": [
"GET",
"HEAD"
],
"AllowedOrigins": [
"*"
],
"ExposeHeaders": [
"Access-Control-Allow-Origin"
]
}
]
```

Start by locating the deployment or infrastructure configuration that creates the buckets holding static resources for review environments; the issue does not name a file or entry point. Apply the requested CORS settings there and verify that a second review-environment deployment no longer produces browser CORS errors when loading static resources.

Written by the indexing model from the issue text.