While working on this question I realized that the blockinfile will do what I want:
- name: Create SSH config block
blockinfile:
path: /root/.ssh/config
block: |
Host backup-{{ restic_backup_name }}
HostName {{ restic_backup_host }}
User restic-backup
IdentityFile /etc/restic/{{ restic_backup_name }}.key
backup: yes
validate: /usr/sbin/sshd -T -f %s