Fix Catastrophic Regex (ReDoS)

The function below validates a username using a regular expression with a nested quantifier: /^([a-z0-9_]+)+$/.

The bug: this pattern is vulnerable to Regular Expression Denial of Service (ReDoS). For certain crafted inputs, the regex engine's backtracking takes exponential time — a string of ~25 valid characters followed by one invalid character can freeze the event loop for seconds, blocking every other request on the server.

Your task: fix solve(username) so it validates the same rule — 3 to 20 lowercase letters, digits, or underscores — without the vulnerable nested-quantifier pattern.

solve('john_doe')  // → true
solve('jo')        // → false (too short)
solve('John_Doe')  // → false (uppercase not allowed)