When I encountered this error in NetBeans 8.0/Glassfish 4.0, I found that the reason was my WSDL file had a UTF-8 byte order mark at the start (0xEF, 0xBB, 0xBF). I'm not sure why that would cause a problem, but removing the BOM made the Quality of Service tab show editable controls for Security and Transport.
The BOM can be removed in Notepad2 on Windows by opening the file, and then selecting File -> Encoding and changing from "UTF-8 Signature" to "UTF-8". Save the file and the BOM is removed. Refresh your web service reference and the QoS tab should work, assuming you don't have some further problem.