OS: RedHat 7.2 (because it's as good as anything else and most popular which means that you have the greatest chance to find the software/help from other people on the net).
If you don't want your box to be hacked, don't plug it into Internet or run behind a tight firewall e.g. in a hardware router with NAT. Really. If you don't have the expertise to secure your box then don't take risks or acquire the expertise.
If you just want to learn *nix, databases, programming, XML then expect to be a beginner after 5 years of hard work (http://www.norvig.com/21-days.html). In other words: don't expect anyone to give you a reasonable advice on achieving such broad goals because there is none (except maybe: work hard, read books, program a lot etc.). If you want reasonable advice set reasonable goals.
Whether you'll use PostgreSQL or Oracle, RedHat 7.2 or FreeBSD, ACS or OpenACS doesn't really matter. Just pick one and run. Fundamentals are important and they are the same. Details like difference between rpm or dpkg are not important. For learning all those choices are good.
