What is the recommended way to validate input?

What is the recommended way to validate input? Some more questions:
* Is it preferred to handle validation in a plugin or handle it in the database with constraints
* If validating in the database, how to avoid aborting early in order to surface all errors to the client
* How are validation errors typed and how do they bubble up to the GraphQL API