First of all, OSM routinely links to copyrighted, unlicensed material via website=*, image=*, and other keys, so if there’s anything against tagging these images in wikimedia_commons=*, it would be as a matter of project policy rather than copyright protection on our part.
If a data consumer uses wikimedia_commons=* to display an image, as opposed to merely linking it, it needs to determine the licensing information on its own. Fortunately, the Wikimedia Commons API can provide this information and more in structured form. Creative Commons attribution licenses are generally interpreted relatively flexibly. For example, if someone uploads their own work to Wikimedia Commons, merely linking to the image there satisfies the attribution requirement, though some older versions of the license allow the photographer to place more stringent attribution requirements on the work.