### Is there an existing issue for this?

- [X] I have searched the existing issues

### Current Behavior

1. Create a bucket with object locking enabled.
2. Enable versioning in this bucket.
3. Upload file with **key**.  Received **version1** for this file.
4. Put a legal hold lock on the file (  **key** - **version1**).
5. Upload another file with the same **key**.  Received **version2** for this file.
6.  Put a legal hold lock on the file (  **key** - **version2**).
7. Remove the legal hold lock from the first version of the file  (  **key** - **version1**).
8. Try to delete the first version of the file (  **key** - **version1**) -> get An error occurred (AccessDenied) when calling the DeleteObject operation: Access Denied.


The script would run successfully if we change the order of commands (basically remove versions  of the file in reverse order):
(We have one file with version1 and version2, both locked)

- First, remove the lock from the version2.
- Delete version2.
- Remove the lock from version1.
- Delete version1.

### Expected Behavior

After the legal hold lock removed (Status=OFF) from the first uploaded version of the file, files should be accessible for deletion by its key and version.

### How are you starting LocalStack?

With the `localstack` script

### Steps To Reproduce

```
#!/bin/bash

echo -e "\033[0;32mCreate two text files\033[0m"

echo "Some text version 01..." > example-v1.txt
echo "Some text version 02..." > example-v2.txt

echo -e "\033[0;32mCreate bucket\033[0m"
awslocal s3api create-bucket --bucket my-bucket-001 --create-bucket-configuration LocationConstraint=ap-southeast-2 --region ap-southeast-2 --object-lock-enabled-for-bucket

echo -e "\033[0;32mEnable versioning\033[0m"
awslocal s3api put-bucket-versioning --bucket my-bucket-001 --versioning-configuration Status=Enabled

echo -e "\033[0;32mUpload first version of the file\033[0m"
version1=$(awslocal s3api put-object --bucket my-bucket-001 --key 123456789 --body example-v1.txt | jq -r '.VersionId')

echo -e "\033[0;32mPut lock on the version1 of the file\033[0m"
awslocal s3api put-object-legal-hold --bucket my-bucket-001 --key 123456789 --version-id $version1 --legal-hold Status=ON

echo -e "\033[0;32mUpload second version of the file\033[0m"
version2=$(awslocal s3api put-object --bucket my-bucket-001 --key 123456789 --body example-v2.txt | jq -r '.VersionId')

echo -e "\033[0;32mPut lock on the version2 of the file\033[0m"
awslocal s3api put-object-legal-hold --bucket my-bucket-001 --key 123456789 --version-id version2 --legal-hold Status=ON

echo -e "\033[0;32mRemove lock from the version1 of the file\033[0m"
awslocal s3api put-object-legal-hold --bucket my-bucket-001 --key 123456789 --version-id version1 --legal-hold Status=OFF

echo -e "\033[0;32mDelete version1 of the file\033[0m"
awslocal s3api delete-object --bucket my-bucket-001 --key 123456789 --version-id $version1
```

### Environment

```markdown
- OS: macOS 13.3.1
- LocalStack: latest, 2.0.2, 2.0.3.dev
```


### Anything else?

_No response_
return f"{_endpoint_url(region, localstack_host)}/{bucket_name}"
def _website_bucket_url(bucket_name: str):
    # TODO depending on region the syntax of the website vary (dot vs dash before region)
    if os.environ.get("TEST_TARGET") == "AWS_CLOUD":
        region = config.AWS_REGION_US_EAST_1
        return f"http://{bucket_name}.s3-website-{region}.amazonaws.com"
    return _bucket_url_vhost(bucket_name, localstack_host=constants.S3_STATIC_WEBSITE_HOSTNAME)
def _bucket_url_vhost(bucket_name: str, region: str = "", localstack_host: str = None) -> str:
    if not region:
        region = config.AWS_REGION_US_EAST_1
    if os.environ.get("TEST_TARGET") == "AWS_CLOUD":
        if region == "us-east-1":
            return f"https://{bucket_name}.s3.amazonaws.com"
        else:
            return f"https://{bucket_name}.s3.{region}.amazonaws.com"
    host = localstack_host or (
        f"s3.{region}.{LOCALHOST_HOSTNAME}" if region != "us-east-1" else S3_VIRTUAL_HOSTNAME
    )
    s3_edge_url = config.get_edge_url(localstack_hostname=host)
    # TODO might add the region here
    return s3_edge_url.replace(f"://{host}", f"://{bucket_name}.{host}")
def _generate_presigned_url(
    client: "S3Client", params: dict, expires: int, client_method: str = "get_"
) -> str:
    return client.generate_presigned_url(
        client_method,
        Params=params,
        ExpiresIn=expires,
    )
def _make_url_invalid(url_prefix: str, _key: str, url: str) -> str: