Java client that consumes a RESTful web service created using Jersey 2
Realistically these are about the same.  WebTarget is a standard part of JAX-RS so if you were to move to another provider like RestEasy you wouldn't have to port it.  If you like standards then this would be the way to go.

HttpClient is common though not a standard in the JSR way.  It is very powerful and sometimes easier to use when you've got specialized requirements like custom SSL processing.  It is, however, a pain to keep up with.  Every release seems to deprecate something I'm using.

The security of either will depend on you - the libraries will not be significantly different in this area and it will be up to you to implement the code well.

Performance is also likely to be similar.  It's highly likely that the performance of your system will be dependent on something that takes significantly more time than any differences in these libraries.

I would always vote for code that is more readable and I'd argue the WebTarget way is easier to read.