Sorry, but I fail to see how one would lose polymorphism?
Edit: and just to hammer it home, that could be $user->save(), $account->save(), $post->save(), $article->save(), whatever you like, it would have the same $anything->save() interface. That's polymorphism, and you loose it if you make the validation external to the thing being saved.
Totally agreeing on the generic rules, I'd assemble them in different Validators and have $validator->validate($something); (which is why I fail to see how you'd lose polymorphism)
As an aside, I wouldn't want explicit UsernameRule or PasswordRules, I'd rather more generic IssetRule and LengthRule classes. You could always use custom ones, but those strike me as a better base set to have.