Summary
Select STARTTLS or SSL/TLS on connection. Unless told otherwise by your administrator use normal password on authentication.
If your connection is secure, the password may be sent unencrypted through the encrypted connection.
If the connection is not secure, using a secure authentication keeps your password protected. But it may allow an attacker to take over your tcp-connection and do anything within the connection that you can do: read mails, move them around, delete them, flag them, etc.
Connection
none: Unencrypted connection, do not use
ssl/tls: Start a secure connection on a IMAP port dedicated to secure connections (993). This is similar to https.
starttls: The connection is done on the traditional IMAP port (143) but one of the first commands is STARTTLS, which means starting encryption just like TLS/SSL.
Authentication
Normal password: Unencrypted password. This is okay, on a secure connection
Encrypted Password: The password is encrypted somehow. There are different standards.
Kerberos: Kerberos is a single sign on infrastructure. If your computer and the mailserver are member of the same trust domain, Kerberos allows you to access you mails based on your operating system domain login.
NTLM: Similar to Kerberos but Microsoft specific
TLS Certificate: In most cases only the server has a key pair and a certificate to prove its identity. But this approach can be applied on the client as well. That's especially interesting if the private key is stored on a smart card.