I've been scratching my head over these web.config settings for a couple of years now, so I went to look up exactly what they are...
Here is what I have determined (paraphrased):
Windows vs Forms authentication: If you select Windows authentication, IIS will do all the authentication work. If you select Forms authentication, you need to add code to your application to do the authentication. If I read this right, you will probably always want Forms Authentication with DNN, so the login procedure can be controlled by the application, not IIS.
To use identity impersonation or not: If you leave the line commented out, the application runs as the user if they are able to authenticate locally, otherwise as the user IIS runs as. If you uncomment it, and leave it as <identity impersonate="true">, your process will always run as the user that IIS runs as. If you expand that to include a username and password, the process will run as that user instead of the IIS user. To me, this seems like a duplication of effort, as you've already entered a username/password in the Admin->Authentication menu that you want to use to access the AD with. I think you only need to uncomment this line in the first place if your webserver is locked down tight, and has trouble doing authentication calls without help.
It would be great if the new provider could be written so that you don't have to make any changes to the web.config at all!