Fix clusterExtension handling of events and access. (#1355)

clusterExtension handling was ignoring (1) events and (2) access modifiers (so
anything using those in a clusterExtension would cause incorrect permissions to
be applied, leading to security bugs).

This fixes both issues.