<!--- Verify first that your issue is not already reported on GitHub -->
<!--- Also test if the latest release and devel branch are affected too -->
<!--- Complete *all* sections as described, this form is processed automatically -->

##### SUMMARY

If I attempt to add a key for `host.example.com` ansible removes my `@cert-authority *.example.com`

##### ISSUE TYPE
- Bug Report

##### COMPONENT NAME
known_hosts

##### ANSIBLE VERSION
<!--- Paste verbatim output from "ansible --version" between quotes -->
```paste below
ansible-playbook 2.9.10
  config file = None
  configured module search path = ['/root/.ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /usr/local/lib/python3.7/dist-packages/ansible
  executable location = /usr/local/bin/ansible-playbook
  python version = 3.7.3 (default, Dec 20 2019, 18:57:59) [GCC 8.3.0]
```

##### CONFIGURATION

Completely default

##### OS / ENVIRONMENT

Docker image on amd64 running debian:buster-slim    image id: 43e3995ee54a
Installed via pip


##### STEPS TO REPRODUCE

play.yml

    - hosts: localhost
      gather_facts: no
      vars:
        known_hosts_path:
        example_com_ed25519_key: >
          host.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFp8VtD59XAcxkj1qbfCtB1in9nm5WiipORjtVJUBA6I
      tasks:

      - name: Create a copy of known_hosts
        copy:
          src: existing_known_hosts
          dest: test_known_hosts

      - name: add the ed25519 host key
        known_hosts:
          name: host.example.com
          key: "{{ example_com_ed25519_key }}"
          state: present
          path: "test_known_hosts"
        register: result

      - name: get the file content
        command: "cat test_known_hosts"
        register: known_hosts_v1

      - name: assert that the key was added and ordering preserved
        assert:
          that:
          - 'result is changed'
          - 'known_hosts_v1.stdout_lines[-1].strip() == example_com_ed25519_key.strip()'
          - 'known_hosts_v1.stdout_lines[4].startswith("@cert-authority")'

existing_known_hosts

    example.com ssh-dss AAAAB3NzaC1kc3MAAACBALT8YHxZ59d8yX4oQNPbpdK9AMPRQGKFY9X13S2fp4UMPijiB3ETxU1bAyVTjTbsoag065naFt13aIVl+u0MDPfMuYgVJFEorAZkDlBixvT25zpKyQhI4CtHhZ9Y9YWug4xLqSaFUYEPO31Bie7k8xRfDwsHtzTRPp/0zRURwARHAAAAFQDLx2DZMm3cR8cZtbq4zdSvkXLh0wAAAIAalkQYziu2b5dDRQMiFpDLpPdbymyVhDMmRKnXwAB1+dhGyJLGvfe0xO+ibqGXMp1aZ1iC3a/vHTpYKDVqKIIpFg5r0fxAcAZkJR0aRC8RDxW/IclbIliETD71osIT8I47OFc7vAVCWP8JbV3ZYzR+i98WUkmZ4/ZUzsDl2gi7WAAAAIAsdTGwAo4Fs784TdP2tIHCqxAIz2k4tWmZyeRmXkH5K/P1o9XSh3RNxvFKK7BY6dQK+h9jLunMBs0SCzhMoTcXaJq331kmLJltjq5peo0PnLGnQz5pas0PD7p7gb+soklmHoVp7J2oMC/U4N1Rxr6g9sv8Rpsf1PTPDT3sEbze6A== root@freezer
    @cert-authority *.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDXh1gk2xgS2MekPvo7ZEKiOT7HoyvOAzai2GqoLXGHO
    # example.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM6OSqweGdPdQ/metQaf738AdN3P+itYp1AypOTgXkyj root@localhost

Output

    # ansible-playbook play.yml --diff
    [WARNING]: No inventory was parsed, only implicit localhost is available
    [WARNING]: provided hosts list is empty, only localhost is available. Note that the implicit localhost does not match 'all'

    PLAY [localhost] *************************************************************************************************************
    ...
    TASK [add the ed25519 host key] **********************************************************************************************
    --- before: test_known_hosts
    +++ after: test_known_hosts
    @@ -1,3 +1,3 @@
     example.com ssh-dss AAAAB3NzaC1kc3MAAACBALT8YHxZ59d8yX4oQNPbpdK9AMPRQGKFY9X13S2fp4UMPijiB3ETxU1bAyVTjTbsoag065naFt13aIVl+u0MDPfMuYgVJFEorAZkDlBixvT25zpKyQhI4CtHhZ9Y9YWug4xLqSaFUYEPO31Bie7k8xRfDwsHtzTRPp/0zRURwARHAAAAFQDLx2DZMm3cR8cZtbq4zdSvkXLh0wAAAIAalkQYziu2b5dDRQMiFpDLpPdbymyVhDMmRKnXwAB1+dhGyJLGvfe0xO+ibqGXMp1aZ1iC3a/vHTpYKDVqKIIpFg5r0fxAcAZkJR0aRC8RDxW/IclbIliETD71osIT8I47OFc7vAVCWP8JbV3ZYzR+i98WUkmZ4/ZUzsDl2gi7WAAAAIAsdTGwAo4Fs784TdP2tIHCqxAIz2k4tWmZyeRmXkH5K/P1o9XSh3RNxvFKK7BY6dQK+h9jLunMBs0SCzhMoTcXaJq331kmLJltjq5peo0PnLGnQz5pas0PD7p7gb+soklmHoVp7J2oMC/U4N1Rxr6g9sv8Rpsf1PTPDT3sEbze6A== root@freezer
    -@cert-authority *.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDXh1gk2xgS2MekPvo7ZEKiOT7HoyvOAzai2GqoLXGHO
     # example.net ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM6OSqweGdPdQ/metQaf738AdN3P+itYp1AypOTgXkyj root@localhost
    +host.example.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFp8VtD59XAcxkj1qbfCtB1in9nm5WiipORjtVJUBA6I

    changed: [localhost]

    TASK [get the file content] **************************************************************************************************
    changed: [localhost]

    TASK [assert that the key was added and ordering preserved] ******************************************************************
    fatal: [localhost]: FAILED! => {"msg": "The conditional check 'known_hosts_v1.stdout_lines[4].startswith(\"@cert-authority\")' failed. The error was: error while evaluating conditional (known_hosts_v1.stdout_lines[4].startswith(\"@cert-authority\")): list object has no element 4"}

    PLAY RECAP *******************************************************************************************************************
    localhost                  : ok=3    changed=3    unreachable=0    failed=1    skipped=0    rescued=0    ignored=0

##### EXPECTED RESULTS
<!--- Describe what you expected to happen when running the steps above -->

I expected adding `hosts.example.com` not to have the side effect of removing `@cert-authority *.example.com ...`

##### ACTUAL RESULTS

See Above
- Starting at Ansible 2.2, multiple entries per host are allowed, but only one for each key type supported by ssh.
     This is useful if you're going to want to use the M(ansible.builtin.git) module over ssh, for example.
   - If you have a very large number of host keys to manage, you will find the M(ansible.builtin.template) module more useful.
version_added: "1.9"
options:
  name:
    aliases: [ 'host' ]
    description:
      - The host to add or remove (must match a host specified in key). It will be converted to lowercase so that ssh-keygen can find it.
      - Must match with <hostname> or <ip> present in key attribute.
      - For custom SSH port, O(name) needs to specify port as well. See example section.
    type: str
    required: true
  key:
    description:
      - The SSH public host key, as a string.
      - Required if O(state=present), optional when O(state=absent), in which case all keys for the host are removed.
      - The key must be in the right format for SSH (see sshd(8), section "SSH_KNOWN_HOSTS FILE FORMAT").
      - Specifically, the key should not match the format that is found in an SSH pubkey file, but should rather have the hostname prepended to a
        line that includes the pubkey, the same way that it would appear in the known_hosts file. The value prepended to the line must also match
        the value of the name parameter.
      - Should be of format C(<hostname[,IP]> ssh-rsa <pubkey>).
      - For custom SSH port, O(key) needs to specify port as well. See example section.
    type: str
  path:
    description:
      - The known_hosts file to edit.
      - The known_hosts file will be created if needed. The rest of the path must exist prior to running the module.
    default: "~/.ssh/known_hosts"
    type: path