Ahh so we have found now the solution: We needed to rename the config xml file to "com.adobe.granite.cors.impl.CORSPolicyImpl-IDENTIFIER.xml".
So we needed to add a Dash between the Factory PID and the IDENTIFIER.
Before we added manually via the Felix Config console the additional config and then we simply packaged up the stored config nodes from the CRX. But this procedure seems not to work for Factory configs.
As you can see JaideepBrar in my previous comment with the Screenshot, we used actually the same PID ("com.adobe.granite.cors.impl.CORSPolicyImpl.c9d2e058-2403-43ac-8755-a5693ddf4ae8")...that's why we are a bit confused....
sorry need to correct my initial description: The configuration worked so far for one added custom configuration, but it is displayed not right below the "Adobe Granite Cross-Origin Resource Sharing Policy" in the Felix Configuration view, which was a bit confusing.