First of all, you do not really have to ever submit anything to Google. Your website will eventually be picked up (it goes really quickly actually, as long as you create a home page quickly after you purchased your domain name.)
On my end, I am removing all the "WWW" as you call them and use a 301 to send my users to the HTTPS version, always. Servers are so fast now a day, I don't see much reasons for not doing so.
That being said, the Google Console does let you enter both, but they are both viewed as separate websites.
That means one is going to be seen as a duplicate of the other, although I think Google understand that it happens within the same domain and probably doesn't penalize as much as when you have real duplicates inter-domain.
I actually have one site which I can't just all redirect to a single URL and I still get hits so I can tell that they have some way of knowing that URLs that match / are close enough, do not represent duplicate content.
As for which one to use, Matt Cutts says that the Google Search Engine does not really give a better chance to secure pages. However, from experience, I have seen Google results returning only the HTTPS results, no matter what. Also Google says here that it is preferable to use HTTPS if possible:
Google recommends that all websites use https:// when possible.
So my recommendation, if you can / don't mind, is to 301 all HTTP traffic to HTTPS. Even though Matt Cutts says it won't make a difference, on the sites where I've done so, I feel like they get more traffic (I changed a couple other things at the same time, but I'm pretty such this is a relatively strong factor.)