My vote would be number 3, with number 2 as a close second. I suppose it depends on the rest of your infrastructure. To my knowledge, AJP doesn't support encryption between hosts.
Number 3 allows you to implement an N Tiered architecture. Ideally the Apache server would be parsing/URL filtering for malicious traffic and not blindly proxying all requests to the Tomcat server.
There is a fairly decent article (with comments) here: https://communities.bmc.com/community/bmcdn/bmc_atrium_and_foundation_technologies/bmc_remedy_ar_system/blog/2013/12/20/the-pulse-why-should-i-use-a-web-server-to-front-tomcat
Even with that being said, there still seems to be some confusion as to whether Tomcat is a Webserver, an Appserver, or both! There are conflicting answers for this question.
If it were me, I'd still choose number 3 based on the above.