In order for the client libraries under /apps to be accessible, a proxy servelt is used. The ACLs are still enforced on the client library folder, but the servlet allows for the content to be read via /etc.clientlibs/ if the allowProxy property is set to true.
A static resource can only be accessed via the proxy, if it resides below a resource below the client library folder.
As an example:
You have a clientlib in /apps/myproject/clientlibs/foo
You have a static image in /apps/myprojects/clientlibs/foo/resources/icon.png
Then you set the allowProxy property on foo to true.
You can then request /etc.clientlibs/myprojects/clientlibs/foo.js
You can then reference the image via /etc.clientlibs/myprojects/clientlibs/foo/resources/icon.png