As reported in https://github.com/localstack/localstack/issues/6659#issuecomment-1630932643_, `HeadObject` does not respect `ChecksumMode`. 


```shell
at 09:31:57 ➜ AWS_DEFAULT_REGION=us-west-1 aws --endpoint-url=http://localhost:4566 s3api create-bucket --bucket test-bucket --create-bucket-configuration LocationConstraint=us-west-1
{
    "Location": "http://test-bucket.s3.localhost.localstack.cloud:4566/"
}

at 09:32:13 ➜ aws --endpoint-url=http://localhost:4566 s3api put-object --bucket test-bucket --key file.json --body README.md --checksum-algorithm SHA256
{
    "ETag": "\"4bb2f1387449d690bff6336ea255909c\"",
    "ChecksumSHA256": "bzOikXXMUqRTCrpVq7Pt7LjJ0fjR3ccUfM19S/gnfqA="
}

# SHA256 missing here
at 09:32:20 ➜ aws --endpoint-url=http://localhost:4566 s3api head-object --bucket test-bucket --key file.json --checksum-mode Enabled
{
    "AcceptRanges": "bytes",
    "LastModified": "2023-07-11T13:32:15+00:00",
    "ContentLength": 1455,
    "ETag": "\"4bb2f1387449d690bff6336ea255909c\"",
    "ContentType": "binary/octet-stream",
    "Metadata": {}
}
```

Note the equivalent response from S3 actual includes the SHA256 value

```shell
at 10:21:23 ➜ aws s3api head-object --bucket test-bucket --key file.json --checksum-mode Enabled
{
    "AcceptRanges": "bytes",
    "Expiration": "expiry-date=\"Thu, 13 Jul 2023 00:00:00 GMT\", rule-id=\"all\"",
    "LastModified": "2023-07-11T14:21:09+00:00",
    "ContentLength": 1956,
    "ChecksumSHA256": "bj7fqCqtaF95M1ULwQRDJuHbL/Xd9NVMH6pua9OINcc=",
    "ETag": "\"f4be535d45019a4408dd5369986919f8\"",
    "ContentEncoding": "",
    "ContentType": "binary/octet-stream",
   
    "Metadata": {},
    
}
```

_Originally posted by @bdurrani in https://github.com/localstack/localstack/issues/6659#issuecomment-1630932643_
            
if grant.get("Permission") not in s3_constants.VALID_GRANTEE_PERMISSIONS:
            raise MalformedACLError(
                "The XML you provided was not well-formed or did not validate against our published schema"
            )
        grantee = grant.get("Grantee", {})
        grant_type = grantee.get("Type")
        if grant_type not in (
            GranteeType.Group,
            GranteeType.CanonicalUser,
            GranteeType.AmazonCustomerByEmail,
        ):
            raise MalformedACLError(
                "The XML you provided was not well-formed or did not validate against our published schema"
            )
        elif (
            grant_type == GranteeType.Group
            and (grant_uri := grantee.get("URI", ""))
            not in s3_constants.VALID_ACL_PREDEFINED_GROUPS
        ):
            ex = _create_invalid_argument_exc("Invalid group uri", "Group/URI", grant_uri)
            raise ex
        elif grant_type == GranteeType.AmazonCustomerByEmail:
            
            continue
        elif grant_type == GranteeType.CanonicalUser and not is_valid_canonical_id(
            (grantee_id := grantee.get("ID", ""))
        ):
            ex = _create_invalid_argument_exc("Invalid id", "CanonicalUser/ID", grantee_id)
            raise ex
def validate_lifecycle_configuration(lifecycle_conf: BucketLifecycleConfiguration) -> None: