As reported in https://github.com/localstack/localstack/issues/6659#issuecomment-1630932643_, `HeadObject` does not respect `ChecksumMode`. 


```shell
at 09:31:57 ➜ AWS_DEFAULT_REGION=us-west-1 aws --endpoint-url=http://localhost:4566 s3api create-bucket --bucket test-bucket --create-bucket-configuration LocationConstraint=us-west-1
{
    "Location": "http://test-bucket.s3.localhost.localstack.cloud:4566/"
}

at 09:32:13 ➜ aws --endpoint-url=http://localhost:4566 s3api put-object --bucket test-bucket --key file.json --body README.md --checksum-algorithm SHA256
{
    "ETag": "\"4bb2f1387449d690bff6336ea255909c\"",
    "ChecksumSHA256": "bzOikXXMUqRTCrpVq7Pt7LjJ0fjR3ccUfM19S/gnfqA="
}

# SHA256 missing here
at 09:32:20 ➜ aws --endpoint-url=http://localhost:4566 s3api head-object --bucket test-bucket --key file.json --checksum-mode Enabled
{
    "AcceptRanges": "bytes",
    "LastModified": "2023-07-11T13:32:15+00:00",
    "ContentLength": 1455,
    "ETag": "\"4bb2f1387449d690bff6336ea255909c\"",
    "ContentType": "binary/octet-stream",
    "Metadata": {}
}
```

Note the equivalent response from S3 actual includes the SHA256 value

```shell
at 10:21:23 ➜ aws s3api head-object --bucket test-bucket --key file.json --checksum-mode Enabled
{
    "AcceptRanges": "bytes",
    "Expiration": "expiry-date=\"Thu, 13 Jul 2023 00:00:00 GMT\", rule-id=\"all\"",
    "LastModified": "2023-07-11T14:21:09+00:00",
    "ContentLength": 1956,
    "ChecksumSHA256": "bj7fqCqtaF95M1ULwQRDJuHbL/Xd9NVMH6pua9OINcc=",
    "ETag": "\"f4be535d45019a4408dd5369986919f8\"",
    "ContentEncoding": "",
    "ContentType": "binary/octet-stream",
   
    "Metadata": {},
    
}
```

_Originally posted by @bdurrani in https://github.com/localstack/localstack/issues/6659#issuecomment-1630932643_
            
if os.environ.get("TEST_TARGET") == "AWS_CLOUD":
        return boto3.client("s3", config=conf, endpoint_url=endpoint_url)
    # TODO in future this should work with aws_stack.create_external_boto_client
    #      currently it doesn't as authenticate_presign_url_signv2 requires the secret_key to be 'test'
    # return aws_stack.create_external_boto_client(
    #     "s3",
    #     config=conf,
    #     endpoint_url=endpoint_url,
    #     aws_access_key_id=TEST_AWS_ACCESS_KEY_ID,
    # )
    return boto3.client(
        "s3",
        endpoint_url=endpoint_url,
        config=conf,
        aws_access_key_id=TEST_AWS_ACCESS_KEY_ID,
        aws_secret_access_key=TEST_AWS_SECRET_ACCESS_KEY,
    )
def _endpoint_url(region: str = "", localstack_host: str = None) -> str:
    if not region:
        region = config.AWS_REGION_US_EAST_1
    if os.environ.get("TEST_TARGET") == "AWS_CLOUD":
        if region == "us-east-1":
            return "https://s3.amazonaws.com"
        else:
            return f"http://s3.{region}.amazonaws.com"
    if region == "us-east-1":
        return f"{config.get_edge_url(localstack_hostname=localstack_host or S3_VIRTUAL_HOSTNAME)}"
    return config.get_edge_url(f"s3.{region}.{LOCALHOST_HOSTNAME}")
def _bucket_url(bucket_name: str, region: str = "", localstack_host: str = None) -> str: