Even without being a GDPR expert by any stretch, I'd immediately assume that what you're doing at least violates GDPR, personally, simply by gaining direct access to individual student accounts within the University's privileged systems, and processing pages that one would assume have protected personal data.
From your interaction flow (particularly the description of scraping after sending the user to a login page), it sounds like you are having the student log into their account, via the app's embedded web view, NOT via native web authentication services or the external web browser. This gives your application full access to the student's account, as if the application is the student.
This is very different from a token based flow through an external browser or system API where your application could never intercept login information (MitM and other attacks/sniffing/spoofing are possible via embedded web views, etc) or just generally make interactions as if it is the student (presumably, from your flow, how your app is getting the ical uri in the first place?), because the login would occur via a handoff to an external web browser and a returned token.
From your perspective, "what you're doing" with that access matters, and equally you see your "processing" as limited to a single URI. From the University's perspective, "what you SAY you're doing" with that access is immaterial to the fact that you're getting it in the first place. My rather limited (US based, simply basic compliance focused) understanding of GDPR would be that the University is 100% correct if they are taking that stance, because at minimum your actions can be seen as causing a breach of their GDPR duties if they take no action to stop you.
And finally, from a GDPR perspective, my understanding would be that "processing" would constitute everything on the pages your application downloads in order to locate the related URI, even if your application isn't, from your stance, "doing" anything with the rest of what it downloaded. Your app necessarily downloads the entire page(s), this constitutes a form of processing under GDPR:
Chapter 1 Art 4 Section 2
‘processing’ means any operation or set of operations which is
performed on personal data or on sets of personal data, whether or not
by automated means, such as collection, recording, organisation,
structuring, storage, adaptation or alteration, retrieval,
consultation, use, disclosure by transmission, dissemination or
otherwise making available, alignment or combination, restriction,
erasure or destruction;
Even if you "do" nothing with the rest of the page contents, downloading a page (because that's necessarily what happens in order to "more directly" process any part of a page) with GDPR protected personal data is a "retrieval" under GDPR, and thus is definitionally "processing" under GDPR. (I think for this we can skip getting into questions of "storage" in relation to a web view downloading a page and potentially caching what's on it in on device storage, etc, but it's worth keeping in mind when considering legal compliance aspects: any degree of "touching" certain data can constitute legal liabilities and require knowing for sure you have fully scrubbed it)
"my university says my app is illegal"
So, what has your university actually accused you of? You've tagged your question with GDPR, but it's unclear if the university has actually said "your application violates GDPR" and why, or if they've said something else.
Beyond "just" presumably processing GDPR protected data, it's not what you're claiming to be doing or claiming to not be doing, it's what you could do because of what you do, actually, do
Your application is using a flow that grants it direct access to student accounts. This blows past "simple" PII concerns into the fact that you are getting students to log your app into their university accounts. It doesn't matter what you claim your app does or doesn't do with that access, getting that access and the mode in which you are doing so is almost assuredly against the terms of service. You are not providing a generalized web browser, you are providing a targeted application, and comparisons to commercial, generalized web browsers aren't going to make much sense or be credible arguments.
Sensitive Data
If Sensitive Data is present in student accounts, and you have failed to gain proper related consent, gaining access to the account and thereby to the data, even if you are not processing it, even if you are not retrieving it or the pages it resides on, may still place you in related jeopardy given the elevated concerns and rules regarding sensitive data.
Integrity and confidentiality
The University, under GDPR, has a duty to maintain both integrity and confidentiality. Your app's access of the accounts by getting students to log your app in is arguably a breach that the University must take action on. You do not have a formal contract with the University to gain access to student accounts within the University's systems, which is what your app is doing.
Consent and Transparency
Do you properly notify students that your app will be logging in to their accounts as them and thus gaining full access to their accounts, while claiming to only using certain data?
Given the accounts you are accessing and the mode in which you are doing so, you have duties under GDPR, you can't treat it simply as "well all I'm having the app directly use is this uri [so I can ignore GDPR processes and concerns]".
Lawful basis
You may not have a lawful basis for your application's access to the student's account in the first place, just to scrape their schedule uri.
If the schedule uri is to a publicly accessible resource, then you could have the student copy and paste the uri into your app without getting them to log your app into their account.
Equally, you could have the student build out their schedule in your application.
Are these things as "convenient" as having the student log your application in, then your application processing their logged in account page to get the uri? From one standpoint, no. But from another, they're also not as inconvenient as engaging in an un-authorized access of university systems and the university system's copies of student PII, which arguably constitutes a breach for the university under GDPR.
You haven't given adequate and clear enough information to answer more directly to "is it illegal"
But I would caution that what you have said sounds like it probably could be considered to be in violation of GDPR from multiple angles, and given most University policies likely violates your University's policies as a student.
I'm not familiar enough with EU law to be able to even offer much opinion on whether gaining access to student accounts like this, even if you "don't do anything" with that access other than what you claim, is necessarily illegal in the sense of being a criminal act (in the US, especially with having been told explicitly that you are not authorized, it could certainly be considered and charged as such under CFAA at least, and possibly other state and federal acts). Factors such as whether you are intentionally spoofing as a web browser (changing the agent string in the headers or otherwise) to gain access, etc, would surely also come into play.
Separately, note that when it comes to things like OAuth, using embedded web views is considered a regressive pattern, and platform providers are supposed to attempt to avoid allowing it to the best of their ability. (see: OAuth "Use a System Browser") (Apple's version of what OAuth advises in terms of leveraging available on device APIs would be, for example, ASWebAuthenticationSession as described in "Authenticating a User Through a Web Service")
Personally, my concern would be that if your actions breach the University's own duties under GDPR, they would in that theory have a duty to report them as a breach, which may place you at minimum in a situation where you are investigated by law enforcement and may have some liability. Even if it's impossible to say whether or not what you are doing is truly "illegal" without being charged with something and it going to court, particularly in the criminal sense, my concern would be one where it certainly seems like something with at least civil jeopardy aspects, and my understanding is that GDPR violations are pursued relatively stringently. I would find a route to do this that doesn't involve gaining access to student accounts using the student's direct login, personally.
