I would say that it should be listed as a dependency of the npm package as this would make it automatically install for the user. It would be a bit strange to also make them install `validate.js` in addition to the stimulus library.
It is true that several gems exist for handling this. however, from my experience, unless a gem provides functionality beyond my desire to create said functionality, it is better to either create and maintain your own gem or have it baked into your application. I say this because I have seen so many cases where gems are not kept up to date or have complications with Rails updates.
I think that some gems are fine to add, but I do take careful consideration before adding them in.