Yes to both questions, the JavaScript API can consume both secure and unsecure WebSocket and ArcGIS for Server with GeoEvent Extension can serve both.
GeoEvent will serve the Stream Service according to your ArcGIS for Server security settings. Therefore if HTTPS is enabled for your Map Services, a WSS connection will be available with the Stream Service. On the other hand, if only HTTP is enabled for your Map Services, only a WS connection will be available.