[SalesForce] Authentication for custom Apex SOAP web service

Answering your questions in order:

• In the interactive web server/user-agent flows, the user submits their credentials directly to Salesforce, and the app receives the short-lived access token and, optionally, a long-lived refresh token. The refresh token is scoped to that application, and may be revoked by the user or an admin at any time, without any impact on other applications. The admin can even set policy for refresh tokens, choosing to invalidate them after some period of inactivity etc. This is not true of username/password - the user shares their Salesforce credentials with the application. If, at a later time, the user decides that they do not trust that app, they needs to change their password at Salesforce, and update any other apps that might be holding the username and password.
• The app is responsible for safely handling and, possibly, storing those credentials, which have much wider scope than the refresh token. It's not that the username/password flow is less secure than the interactive flows, it's that the responsibilities of the app are much greater, and the consequences, if the app does not fulfill those responsibilities, more severe.
• They are not sent as URL parameters, but posted as application/x-www-form-urlencoded data - see this article.

I would advise you to consider one of the interactive flows, and store the refresh token, or even JWT Bearer Token flow, where the app creates a signed token, rather than username-password, which should be considered a last resort, when no other option is available.

You will need to set the endpoint for the client based on the LoginResult serverUrl.

The login call will go to login.salesforce.com. When it comes back the serverUrl will be something like https://na5.salesforce.com/services/Soap/u/34.0.

partnerSoapSforceCom.Soap partner = new partnerSoapSforceCom.Soap();
partnerSoapSforceCom.LoginResult lr = partner.login('user@example.com', 'SomePassword' + 'SomeSecurityToken');    

ARTaskWebService.AR_getActivitiesWebservice client = new ARTaskWebService.AR_getActivitiesWebservice();
client.SessionHeader = new ARTaskWebService.SessionHeader_element();
client.SessionHeader.sessionId = lr.sessionId;

// You may need to adjust this if using a custom Apex Soap service.
client.endpoint__x = lr.serverUrl;

Since your Apex class Soap class probably has an endpoint like https://na8.salesforce.com/services/Soap/class/AR_getActivitiesWebservice you may need to adjust this using the domain in the LoginResult serverUrl.

E.g. replace the na8 pod identifier in your current endpoint with na5 if that is what the serverUrl comes back with.