How does postgres host based authentication work?
A local connection uses a Unix-domain socket; a host connection uses TCP.
The linked page says that


  you need to enable TCP/IP connections (DSpace uses JDBC)


… because JDBC does not have built-in support for Unix-domain sockets.

As long as a connection is allowed only from localhost (as configured in pg_hba.conf) and only to localhost (as configued by listen_addresses), it is as secure as a local connection.

The md5 is just an option that specifies how the password is to be encrypted during the connection setup; this is handled automatically by the JDBC driver. For a local connection, or for a connection over SSL, this does not really matter.