Unfortunately you have reached the limits of what SPWebConfigModification can do, you need to do the changes manually, i like xml transforms.
But once you know you need to do 'some' changes manually, you may as well to them all manually, because the SPWebConfigModification mods will conflict with your manual mods.
And SPWebConfigModification's can not be used to make changes to service application web.configs (Security Token Service Application), so i rarely use them now.
$configpath = ((get-item "IIS:\Sites\$iispath").physicalPath + "\web.config")
$config = [xml](get-content $configpath)
$attr = $config.CreateAttribute("enabled")
$attr.psbase.Value = "true"
$config.Configuration."system.web".roleManager.SetAttributeNode($attr) | out-null
$node = (Select-Xml -Xml $config -XPath "/configuration/system.web/membership/providers/add['AspNetSqlMembershipProvider']").Node
$attr = $config.CreateAttribute("connectionStringName")
$attr.psbase.Value = "AspNetSqlMemberShipProvider"
$node.SetAttributeNode($attr) | out-null
$attr = $config.CreateAttribute("enablePasswordRetrieval")
$attr.psbase.Value = "false"
$node.SetAttributeNode($attr) | out-null
$attr = $config.CreateAttribute("enablePasswordReset")
$attr.psbase.Value = "true"
$node.SetAttributeNode($attr) | out-null
$attr = $config.CreateAttribute("requiresQuestionAndAnswer")
$attr.psbase.Value = "true"
$node.SetAttributeNode($attr) | out-null
$attr = $config.CreateAttribute("passwordAttemptWindow")
$attr.psbase.Value = "10"
$node.SetAttributeNode($attr) | out-null
$attr = $config.CreateAttribute("applicationName")
$attr.psbase.Value = "/"
$node.SetAttributeNode($attr) | out-null
$attr = $config.CreateAttribute("requiresUniqueEmail")
$attr.psbase.Value = "false"
$node.SetAttributeNode($attr) | out-null
$attr = $config.CreateAttribute("passwordFormat")
$attr.psbase.Value = "Hashed"
$node.SetAttributeNode($attr) | out-null
$node = (Select-Xml -Xml $config -XPath "/configuration/system.web/roleManager/providers/add['AspNetSqlRoleProvider']").Node
$attr = $config.CreateAttribute("connectionStringName")
$attr.psbase.Value = "AspNetSqlMemberShipProvider"
$node.SetAttributeNode($attr) | out-null
$attr = $config.CreateAttribute("applicationName")
$attr.psbase.Value = "/"
$node.SetAttributeNode($attr) | out-null
Copy-Item $configpath "$configpath.$(get-date -f yyyyMMddhhmmss).config"
$config.Save($configpath);