Their current CLA provides for a full copyright license grant: https://www.hashicorp.com/cla Assuming that's not new (and I have no reason to believe it is) then contributors were already signing away their right to be choosy in that regard; Hashicorp can already relicense any previous contribution, which is why this change is even possibly in the first place.
I agree that it might cause some bad vibes, but it's no different for these in-flight PRs than it is for all of the historical ones that were already merged.
Regardless, the legality of it does not matter. The already significant social consequence would be compounded if they chose to merge something that the contributor no longer wanted to see merged. It might be legal, but it treads even further into an ethical gray area.