A quick search through the WP-API source revealed where validate_callback is being used:
wp-api/lib/infrastructure/class-wp-rest-request.php
$valid_check = call_user_func( $arg['validate_callback'], $param, $this, $key );
In this case, $this is an instance of WP_Rest_Request – so there’s one. Now, for sanitize_callback:
$this->params[ $type ][ $key ] = call_user_func( $attributes['args'][ $key ]['sanitize_callback'], $value, $this, $key );
Same file, there’s the $this you’re looking for. So yes, both should get an instance of WP_Rest_Request as their second argument.