I see it as a rules matrix to be checked.

I'd take

$index= min( int(length /4), 5 )

And an array of arrays @rules for lookup.

The rules array would contain subs which all must return true for the password to pass.

Like $letter = sub {  /[a-z]/i }

(This will test against $_ )

So $rules[3] = [ $letter, $number ]

$rules[1] = [ $forbidden ]

All you need to do now is too loop over all rules and fail if one entry returns false.

HTH! :)

PS instead of code refs one might also store regex refs with qr//.

But why blocking the way to more complicated rules?