Yes, Basic Authentication sends passwords in plain text. If your website runs over SSL, then this makes all communication (including the Basic Authentication) secure.
Integrated Windows Authentication just refers to the fact that IIS will check any incoming username/password combinations against Windows users (domain and or local users), rather than checking some other store. You can use integrated authentication with basic (plain text) or digest (md5 hash) styles of transferring credentials. The latter is more secure because the actual password isn't transmitted.
Unless you're running an intranet site where your clients already authenticated with the same Windows domain, I would steer clear of using Integrated Windows Authentication.
Application Authentication basically means you do the authentication yourself within your script/web application. This usually involves collecting a username and password in a normal html form, checking the username/password against your database, and setting a session value indicating the client has been authenticated. This is a portable approach, as it does not require any Windows users to be set up for your clients. Login forms should run over SSL, as forms will pass the password field in plain text.