I think it’s coming from the fact that it is being built on 16.04 and has nothing to do with webkit2gtk-4.0 or gtk+-x11-3.0 as you are linking these in as shared libraries - the dependencies of these libraries don’t really bother you.
More specifically, it depends on which libcurl-dev package you install.
As you probably know there are always two types of packages for (most) shared libraries. A runtime package and a devel package.
The runtime package only contains the shared library which will include the api version suffix: i.e. libcurl4 etc.
The devel package contains all the headers you need, usually a static library variant, a pkg-config config file, and then a symlink (libcurl -> libcurl4) which will allow you to just link against library name without the version (-lcurl) - this is what JUCE does.
I think for libcurl you have the choice of different versions of libcurl-dev packages (libcurl3-dev, libcurl4-dev etc.), but I’m not sure if libcurl4-dev is already available in Ubuntu 16.04 - and if it is, if the runtime package will be installed by default in Ubuntu 16.04. If it isn’t your users will need to install it themselves (or you will need to add a dependency to your debian package).