JavaScript supports all of the needed concepts. You can declare a lexically scoped variable with var. You can return functions from functions. It supports automatic garbage collection. Therefore you can do something like this (haven't fought with JavaScript for a bit, but it should show the idea):

function set_re_validation (elem, re) {
  elem.onclick = function () {
    if (elem.value.match(re)) {
      // Do whatever
    }
    else {
      // Do whatever else
    }
  };
}

(You may need a few var declarations, but I don't think so.)

And now you can have a few other kinds of generic rules as well.

As for the "and" operation in REs, it exists. I don't know which browsers support it, but Perl introduced the idea of lookahead (?=foo) and negative lookahead (?!foo). So you could say something like this for your expression in Perl:

/^(?!.*&.*&).{4}$/s

Meaning at the start of the string, don't let me match stuff, &stuff, &, and let me match 4 characters then end of line. The last /s means that . will match newlines, and while \\z is more accurate than $, JavaScript is unlikely to support it. (The difference is that $ can match before a return.)

Cheers,
Ben